Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115319 | low | 2.5 | No | fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to... | 2026-10-29 |
| CVE-2026-108360 | medium | 6.4 | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Workshee... | 2026-10-29 |
| CVE-2026-108359 | not reported | — | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, Ods::pro... | 2026-10-29 |
| CVE-2024-58394 | medium | 6.1 | No | Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying mali... | 2026-10-29 |
| CVE-2022-51024 | high | 7.5 | No | Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplyi... | 2026-10-29 |
| CVE-2021-48017 | high | 7.5 | No | OrbiTeam BSCW Server 5.x before 5.2.5 and 7.x before 7.4.4 contains an unauthenticated path traversal vulnerability in the style_name parame... | 2026-10-29 |
| CVE-2021-48013 | high | 7.5 | No | Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files through the fpath... | 2026-10-29 |
| CVE-2018-25439 | high | 7.5 | No | MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows unauthenticated attackers to read a... | 2026-10-29 |
| CVE-2017-20288 | medium | 6.1 | No | QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts t... | 2026-10-29 |
| CVE-2026-96639 | critical | 9.8 | No | Pillow is a Python imaging library. From 11.0.0 until 13.0.0, multi-frame loaders can retain an ImagingCore allocation created for a narrow... | 2026-10-29 |
| CVE-2026-93865 | not reported | — | No | A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to in... | 2026-10-29 |
| CVE-2026-93864 | not reported | — | No | A link following vulnerability in WatchGuard Fireware OS’s firewall daemon allows a local attacker with code execution as a low-privileged s... | 2026-10-29 |
| CVE-2026-93857 | not reported | — | No | A stack-based buffer overflow vulnerability in Fireware OS's SIP proxy allows a remote, unauthenticated attacker to execute arbitrary code b... | 2026-10-29 |
| CVE-2026-94347 | high | 7.2 | No | PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.70,... | 2026-10-29 |
| CVE-2026-90465 | not reported | — | No | A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as... | 2026-10-29 |
| CVE-2026-90729 | medium | 6.7 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-29 |
| CVE-2026-90728 | medium | 6.3 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-29 |
| CVE-2026-91093 | not reported | — | No | A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow for escalation of priv... | 2026-10-29 |
| CVE-2026-87880 | medium | 6.8 | No | Sensitive information disclosure due to missing SSL certificate verification affecting one component. The following products are affected: A... | 2026-10-29 |
| CVE-2026-87878 | medium | 6.3 | No | Linux binaries have executable stack attribute enabled. The following products are affected: Acronis Cyber Protect 17 (Linux) before build 4... | 2026-10-29 |