Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-59792 | critical | 9.8 | No | In JetBrains IntelliJ IDEA before 2026.1.4, 2026.2 code execution via path traversal in project workspace ID handling was possible | 2026-10-24 |
| CVE-2026-48807 | critical | 9.1 | No | Twig is a template language for PHP. Prior to 3.27.0, the sandbox __toString() checks do not fully cover Traversable values passed to join a... | 2026-10-24 |
| CVE-2026-48806 | critical | 9.1 | No | Twig is a template language for PHP. Prior to 3.27.0, ArrayExpression does not guard dynamic mapping keys that are coerced to strings, allow... | 2026-10-24 |
| CVE-2026-48805 | critical | 9.1 | No | Twig is a template language for PHP. Prior to 3.27.0, deprecated internal wrappers in src/Resources/core.php do not forward the current sand... | 2026-10-24 |
| CVE-2026-46634 | critical | 9.8 | No | Twig is a template language for PHP. From 3.9.0 until 3.26.0, template_from_string() compiles an inner template under a synthesized __string... | 2026-10-24 |
| CVE-2026-13221 | critical | 9.1 | No | Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression mat... | 2026-10-24 |
| CVE-2026-40469 | critical | 9.1 | No | Integer overflow vulnerability has been found in "builtin.c" program file of gawk (do_sub() routine). This issue could be used to overwrite... | 2026-10-24 |
| CVE-2026-40468 | critical | 9.1 | No | Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting o... | 2026-10-24 |
| CVE-2026-57830 | critical | 9.1 | No | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate... | 2026-10-24 |
| CVE-2026-56453 | critical | 9.8 | No | HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the c... | 2026-10-24 |
| CVE-2026-54052 | critical | 9.9 | No | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP... | 2026-10-24 |
| CVE-2026-20157 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehen... | 2026-10-24 |
| CVE-2026-20156 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a comprehen... | 2026-10-24 |
| CVE-2026-24227 | critical | 9.8 | No | NVIDIA TensorRT for contains a vulnerability where a user might cause a deserialization of untrusted data. A successful exploit of this vuln... | 2026-10-24 |
| CVE-2026-58617 | critical | 9.8 | No | Improper access control in Microsoft 365 Copilot for iOS allows an unauthorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-54433 | critical | 10.0 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message... | 2026-10-24 |
| CVE-2026-54058 | critical | 9.1 | No | Pillow is a Python imaging library. Prior to 12.3.0, when Pillow loads an uncompressed McIdas AREA image from a filename through the mmap ra... | 2026-10-24 |
| CVE-2026-62644 | critical | 9.8 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via... | 2026-10-24 |
| CVE-2026-62643 | critical | 10.0 | No | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages ma... | 2026-10-24 |
| CVE-2026-59836 | critical | 9.8 | No | A improper certificate validation vulnerability in Fortinet FortiClientEMS 7.4.3 through 7.4.5, FortiClientEMS 7.4.0 through 7.4.1, FortiCli... | 2026-10-24 |