Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101489 | medium | 4.3 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affecte... | 2026-10-26 |
| CVE-2026-101491 | medium | 5.0 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Query). Supported versions that are affected... | 2026-10-26 |
| CVE-2026-110236 | high | 7.0 | No | KDE Dolphin 24.08.0 through 26.08.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying cr... | 2026-10-26 |
| CVE-2026-110231 | medium | 4.7 | No | muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files outside the destination... | 2026-10-26 |
| CVE-2026-110225 | low | 2.7 | No | Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the server request inter... | 2026-10-26 |
| CVE-2026-110220 | high | 7.1 | No | Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users to steal the control... | 2026-10-26 |
| CVE-2026-110215 | high | 8.8 | No | youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and butto... | 2026-10-26 |
| CVE-2026-110210 | medium | 5.3 | No | Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission... | 2026-10-26 |
| CVE-2026-110111 | high | 7.5 | No | Xen Orchestra before 6.9.0 contains an improper access control vulnerability that allows any authenticated user to become global administrat... | 2026-10-26 |
| CVE-2026-41509 | critical | 9.8 | No | CROSS implementation contains reference and optimized implementations of the CROSS post-quantum signature algorithm. Prior to commit fc6b7e7... | 2026-10-26 |
| CVE-2026-42217 | critical | 9.8 | No | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus... | 2026-10-26 |
| CVE-2026-42216 | critical | 9.1 | No | OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture indus... | 2026-10-26 |
| CVE-2026-44597 | critical | 9.1 | No | Tor before 0.4.9.7 has an out-of-bounds read when an END, a TRUNCATE, or a TRUNCATED cell lacks a reason in its payload, aka TROVE-2026-011. | 2026-10-26 |
| CVE-2026-7910 | critical | 9.6 | No | Use after free in Views in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass... | 2026-10-26 |
| CVE-2026-40010 | critical | 9.1 | No | Missing invocation of Servlet http web request method changeSessionId after session binding can be exploited for a session fixation attack i... | 2026-10-26 |
| CVE-2026-42222 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. In version 2.3.5, an unauthenticated bootstrap takeover exists in nginx-ui during... | 2026-10-26 |
| CVE-2026-42221 | critical | 9.8 | No | Nginx UI is a web user interface for the Nginx web server. From version 2.0.0 to before version 2.3.8, an unauthenticated network attacker c... | 2026-10-26 |
| CVE-2026-26332 | critical | 10.0 | No | vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitr... | 2026-10-26 |
| CVE-2026-25293 | critical | 9.8 | No | Buffer overflow due to incorrect authorization in PLC FW | 2026-10-26 |
| CVE-2026-0300 | critical | 9.8 | Listed | A buffer overflow vulnerability in the User-ID™ Authentication Portal (aka Captive Portal) service of Palo Alto Networks PAN-OS software all... | 2026-10-26 |