Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56449 | high | 7.5 | No | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP... | 2026-10-21 |
| CVE-2026-16487 | not reported | — | No | Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches image... | 2026-10-21 |
| CVE-2026-110927 | not reported | — | No | Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585. | 2026-10-21 |
| CVE-2026-110924 | not reported | — | No | Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553. | 2026-10-21 |
| CVE-2026-110926 | not reported | — | No | Rejected reason: CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582. | 2026-10-21 |
| CVE-2026-110925 | not reported | — | No | Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583. | 2026-10-21 |
| CVE-2026-110923 | not reported | — | No | Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552. | 2026-10-21 |
| CVE-2026-86471 | not reported | — | No | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary... | 2026-10-21 |
| CVE-2026-86922 | high | 8.8 | No | A type confusion issue was addressed with improved state management. This issue is fixed in Safari 27, iOS 27 and iPadOS 27, macOS Golden Ga... | 2026-10-21 |
| CVE-2026-86919 | high | 8.8 | No | A stack overflow was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS... | 2026-10-21 |
| CVE-2026-28328 | high | 8.8 | No | SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access... | 2026-10-21 |
| CVE-2026-76740 | high | 7.2 | No | A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be expl... | 2026-10-21 |
| CVE-2026-106173 | critical | 9.8 | No | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacke... | 2026-10-21 |
| CVE-2026-102438 | not reported | — | No | An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges... | 2026-10-21 |
| CVE-2026-105453 | high | 8.4 | No | IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privi... | 2026-10-21 |
| CVE-2026-101296 | not reported | — | No | A missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL auth... | 2026-10-21 |
| CVE-2026-92262 | critical | 9.9 | No | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the... | 2026-10-21 |
| CVE-2026-95859 | not reported | — | No | libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message ha... | 2026-10-21 |
| CVE-2026-92263 | high | 7.2 | No | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint in... | 2026-10-21 |
| CVE-2026-111609 | low | 3.8 | No | PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription mana... | 2026-10-21 |