Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15412 | medium | 6.5 | No | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 could allow a remote... | 2026-10-22 |
| CVE-2026-11722 | medium | 4.8 | No | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by an HT... | 2026-10-22 |
| CVE-2026-11549 | medium | 6.5 | No | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a vir... | 2026-10-22 |
| CVE-2026-11548 | medium | 4.8 | No | IBM WebSphere Application Server 8.5 and 9.0, and and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are affected by a... | 2026-10-22 |
| CVE-2026-15396 | medium | 6.5 | No | IBM WebSphere Application Server 8.5 and 9.0, and IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 are vulnerable to HTT... | 2026-10-22 |
| CVE-2026-115502 | not reported | — | No | A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and potentially access jobs of oth... | 2026-10-22 |
| CVE-2026-115496 | not reported | — | No | Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow an authenticated remo... | 2026-10-22 |
| CVE-2026-115494 | not reported | — | No | A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an authenticated attacker to... | 2026-10-22 |
| CVE-2026-115482 | high | 7.5 | No | In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered header sets is not li... | 2026-10-22 |
| CVE-2026-115454 | not reported | — | No | An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to version 1.19.0 allows a au... | 2026-10-22 |
| CVE-2026-114570 | medium | 4.9 | No | WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient e... | 2026-10-22 |
| CVE-2026-114220 | critical | 9.1 | No | NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability. Unauthenticated network-adjacent attackers ca... | 2026-10-22 |
| CVE-2026-114219 | high | 7.4 | No | NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the hard-co... | 2026-10-22 |
| CVE-2026-113872 | high | 7.5 | No | multer is a middleware for Node.js that handles multipart/form-data file uploads. In versions from 2.0.0 before 2.5.0, when multer is config... | 2026-10-22 |
| CVE-2026-114057 | medium | 4.3 | No | ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated us... | 2026-10-22 |
| CVE-2026-114047 | medium | 6.8 | No | FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts untrusted target TLS ce... | 2026-10-22 |
| CVE-2026-114042 | medium | 6.5 | No | FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the owned-stream deallocat... | 2026-10-22 |
| CVE-2026-111181 | high | 7.5 | No | body-parser is body parsing middleware for Node.js and Express. In versions before 1.20.9 and in versions from 2.0.0 before 2.4.0, a single... | 2026-10-22 |
| CVE-2026-110354 | high | 7.5 | No | HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread CPU exhaustion) via a... | 2026-10-22 |
| CVE-2026-110353 | high | 7.5 | No | HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU exhaustion) via a truncate... | 2026-10-22 |