Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107885 | medium | 5.5 | No | OpenPrinting CUPS through 2.4.20 contains a resource-exhaustion vulnerability in the submission-timeout handling of cupsdCheckJobs(). The sc... | 2026-10-20 |
| CVE-2026-107886 | medium | 6.5 | No | OpenPrinting CUPS before 2.4.20 contains a double-free in printer-class management. When CUPS-Add-Modify-Class replaces an existing class me... | 2026-10-20 |
| CVE-2026-107888 | medium | 5.5 | No | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference in cupsdCheckJobs() when a job marked job-held-on-create refers to a tem... | 2026-10-20 |
| CVE-2026-107890 | medium | 5.5 | No | OpenPrinting CUPS before 2.4.20 contains a NULL pointer dereference caused by repeated IPP group tags in job-creation requests. IPP parsing... | 2026-10-20 |
| CVE-2026-107805 | high | 7.5 | No | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary... | 2026-10-20 |
| CVE-2026-107806 | high | 7.2 | No | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure sess... | 2026-10-20 |
| CVE-2026-109678 | medium | 6.5 | No | FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the em... | 2026-10-20 |
| CVE-2026-109679 | medium | 5.3 | No | FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 20... | 2026-10-20 |
| CVE-2026-109680 | medium | 6.5 | No | FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes wh... | 2026-10-20 |
| CVE-2026-94131 | high | 8.1 | No | Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could... | 2026-10-20 |
| CVE-2026-94132 | high | 8.1 | No | Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.... | 2026-10-20 |
| CVE-2026-97160 | high | 8.8 | No | Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-97161 | high | 7.5 | No | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-97627 | high | 7.2 | No | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to... | 2026-10-20 |
| CVE-2026-75753 | not reported | — | No | Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP... | 2026-10-20 |
| CVE-2026-17518 | not reported | — | No | Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations... | 2026-10-20 |
| CVE-2026-71253 | critical | 9.8 | No | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads &... | 2026-10-20 |
| CVE-2026-12254 | not reported | — | No | Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point w... | 2026-10-20 |
| CVE-2026-113714 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads di... | 2026-10-20 |
| CVE-2026-113401 | medium | 6.5 | No | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | 2026-10-20 |