Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62392 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. A backend API may... | 2026-10-24 |
| CVE-2026-62390 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. A backend API refreshing... | 2026-10-24 |
| CVE-2026-62422 | critical | 9.8 | No | In JetBrains YouTrack before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, 2024.2.148429 authentication bypass v... | 2026-10-24 |
| CVE-2026-58319 | critical | 9.1 | No | Certain Apache Doris FE HTTP REST administrative APIs were accessible without proper authentication. An unauthenticated attacker with networ... | 2026-10-24 |
| CVE-2026-15410 | high | 7.2 | Listed | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Man... | 2026-10-24 |
| CVE-2026-15409 | critical | 10.0 | Listed | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticat... | 2026-10-24 |
| CVE-2026-91403 | critical | 9.1 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).... | 2026-10-24 |
| CVE-2026-12341 | critical | 9.8 | No | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated attacker unauthorized access to protected APIs and data... | 2026-10-24 |
| CVE-2026-41521 | critical | 9.1 | No | xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update message... | 2026-10-24 |
| CVE-2026-46420 | critical | 9.8 | No | setup-php is a GitHub action to set up PHP with extensions, php.ini configuration, coverage drivers, and tools. From 2.25.0 prior to 2.37.1,... | 2026-10-24 |
| CVE-2026-13473 | critical | 9.8 | No | IBM Storage Protect Client 8.1.0.0 through 8.1.27.0, 8.1.27.1, and 8.2.0.0 through 8.2.1.0 IBM Storage Protect is vulnerable to a heap-based... | 2026-10-24 |
| CVE-2026-13448 | critical | 9.8 | No | IBM Langflow OSS 1.0.0 through 1.10.1 Lanflow OSS contains an unauthenticated remote code execution vulnerability in the public flow build e... | 2026-10-24 |
| CVE-2026-8297 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Gis Informatics Engineering Consulting... | 2026-10-24 |
| CVE-2026-12692 | critical | 9.8 | No | Unverified password change vulnerability in Vimesoft Inc. Enterprise Video Platform allows Authentication Bypass. This issue affects Enterp... | 2026-10-24 |
| CVE-2026-44182 | critical | 10.0 | No | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Sw... | 2026-10-24 |
| CVE-2026-44181 | critical | 10.0 | No | Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Sw... | 2026-10-24 |
| CVE-2026-54526 | critical | 9.9 | No | Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to 3.7.15 and 4.0.6,... | 2026-10-24 |
| CVE-2026-45568 | critical | 9.1 | No | zrok is software for sharing web services, files, and network resources. Prior to 2.0.3, zrok's Python SDK ProxyShare Flask proxy route acce... | 2026-10-24 |
| CVE-2025-27902 | medium | 6.1 | No | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 uses a web link with untrusted references to an external site. A remote attacke... | 2026-10-24 |
| CVE-2025-27896 | medium | 6.1 | No | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthentic... | 2026-10-24 |