Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109566 | critical | 9.8 | No | Rapyd Admin from 9.0.0 before 9.20.0 contains a hard-coded credentials vulnerability that allows remote unauthenticated attackers to gain su... | 2026-10-26 |
| CVE-2026-109356 | medium | 4.3 | No | LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically... | 2026-10-26 |
| CVE-2026-109351 | medium | 6.5 | No | Gitoxide gix-pack before 0.75.0 contains an uncontrolled memory allocation vulnerability that allows remote attackers to abort the process b... | 2026-10-26 |
| CVE-2026-109346 | high | 8.1 | No | better-auth from 1.3.8-beta.3 before 1.7.0-rc.3 contains a UI misrepresentation vulnerability in the deviceAuthorization plugin because GET... | 2026-10-26 |
| CVE-2026-109341 | high | 7.1 | No | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows callers with table-level write permission to read SELECT-r... | 2026-10-26 |
| CVE-2026-109336 | medium | 4.3 | No | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to read fields hidden by field-level SELECT p... | 2026-10-26 |
| CVE-2026-109331 | high | 7.4 | No | Network-AI from 5.14.0 before 5.15.2 contains a security control bypass vulnerability in the ClaudeHookBridge PreToolUse hook, which matches... | 2026-10-26 |
| CVE-2026-109176 | medium | 5.4 | No | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to delete other adm... | 2026-10-26 |
| CVE-2026-109171 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject c... | 2026-10-26 |
| CVE-2026-109164 | high | 7.1 | No | TDuck survey form through 6.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other use... | 2026-10-26 |
| CVE-2025-2708 | critical | 9.1 | No | A vulnerability was identified in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/infra/file/uploa... | 2026-10-26 |
| CVE-2025-2707 | critical | 9.1 | No | A vulnerability was determined in zhijiantianya ruoyi-vue-pro 2.4.1. This impacts an unknown function of the file /app-api/infra/file/upload... | 2026-10-26 |
| CVE-2026-105773 | high | 7.0 | No | Canimaan Software ClamXAV versions 3.3 - 3.11 contains a local privilege escalation vulnerability in the Privileged Helper Tool caused by a... | 2026-10-26 |
| CVE-2020-37282 | critical | 9.8 | No | office-converter through 1.0.2 contains an OS command injection vulnerability that allows attackers to execute commands by supplying a craft... | 2026-10-26 |
| CVE-2026-77062 | not reported | — | No | The boneIO Black web interface lacks proper clickjacking protections. A remote attacker can embed the control panel in an iframe on a malici... | 2026-10-26 |
| CVE-2026-77061 | not reported | — | No | boneIO Black directly excludes several API endpoints from the authentication. An unauthenticated remote attacker on the local network can re... | 2026-10-26 |
| CVE-2026-77060 | not reported | — | No | boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable permissions. Any loca... | 2026-10-26 |
| CVE-2026-77059 | not reported | — | No | boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in boneio/webui/routes/timezone_sudoers.py.... | 2026-10-26 |
| CVE-2026-112250 | medium | 4.4 | No | A vulnerability has been identified in BRAIN2 versions up to and including version 3.09. Under specific installation conditions, the passwor... | 2026-10-26 |
| CVE-2026-42584 | critical | 9.1 | No | Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each in... | 2026-10-26 |