Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-27895 | medium | 6.1 | No | IBM DB2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthentic... | 2026-10-24 |
| CVE-2025-64393 | not reported | — | No | This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. | 2026-10-24 |
| CVE-2026-86517 | medium | 6.3 | No | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli_query of the file /pages/u... | 2026-10-24 |
| CVE-2026-86269 | medium | 6.3 | No | A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/emp_edi... | 2026-10-24 |
| CVE-2026-86265 | medium | 6.3 | No | A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of... | 2026-10-24 |
| CVE-2026-86245 | medium | 6.3 | No | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of t... | 2026-10-24 |
| CVE-2026-9198 | critical | 9.8 | Listed | IBM Langflow OSS 1.0.0 through 1.10.0 allows unauthenticated attackers to chain /api/v1/auto_login (mints SUPERUSER tokens to any network ca... | 2026-10-24 |
| CVE-2026-9586 | critical | 9.8 | Listed | An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content... | 2026-10-24 |
| CVE-2026-8983 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 contains a hard-coded authentication token that bypasses authorization checks for multip... | 2026-10-24 |
| CVE-2026-16441 | critical | 9.6 | No | In Eclipse OpenJ9 versions up to 0.60, when executing class files where a previously concrete superclass method has been recompiled as abstr... | 2026-10-24 |
| CVE-2026-16439 | critical | 9.1 | No | In Eclipse OpenJ9 versions up to 0.60, using -Xtrace to trace method arguments can lead to buffer underflow. | 2026-10-24 |
| CVE-2026-111934 | low | 3.7 | No | Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the leftmost, client-supplied X... | 2026-10-24 |
| CVE-2026-111933 | low | 3.7 | No | Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration vulnerability because... | 2026-10-24 |
| CVE-2025-71435 | medium | 4.2 | No | Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access after OIDC token exp... | 2026-10-24 |
| CVE-2025-27897 | medium | 6.1 | No | IBM Db2 Recovery Expert for Linux, UNIX and Windows 5.5 IF 2 is vulnerable to cross-site scripting. This vulnerability allows an unauthentic... | 2026-10-24 |
| CVE-2026-8986 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection when processing OCPP GetDiagnostics requests. A ma... | 2026-10-24 |
| CVE-2026-8985 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 is vulnerable to OS command injection in the /test endpoint exposed on TCP port 9002. An... | 2026-10-24 |
| CVE-2026-8984 | critical | 9.8 | No | Autel Maxi Charger Single firmware through V1.03.51 allows unauthenticated remote code execution via the service listening on TCP port 9002.... | 2026-10-24 |
| CVE-2026-65768 | critical | 9.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacke... | 2026-10-24 |
| CVE-2026-57104 | critical | 9.6 | No | Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer allows an unauthorized attack... | 2026-10-24 |