Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112159 | medium | 5.5 | No | A security vulnerability has been detected in JumpServer up to 4.10.19. The affected element is an unknown function of the component Templat... | 2026-10-20 |
| CVE-2026-111066 | not reported | — | No | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. From 2.0.0 until 3.14.4, multipart request processing can re... | 2026-10-20 |
| CVE-2026-111059 | medium | 6.1 | No | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. From 3.0.0 until 3.2.11, mr.Markdown convert... | 2026-10-20 |
| CVE-2026-109437 | critical | 9.8 | No | Cognition before 0.13.0 contains an unauthenticated remote code execution vulnerability due to defaulting its agent sandbox backend to local... | 2026-10-20 |
| CVE-2026-107082 | high | 8.8 | No | Slims (Senayan Library Management Systems) 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opac_hide and... | 2026-10-20 |
| CVE-2026-101304 | high | 7.1 | No | When fdescfs(4) was mounted in a jail with the "nodup" option, opening /dev/fd/N returned a descriptor that did not inherit FD_RESOLVE_BENEA... | 2026-10-20 |
| CVE-2026-104937 | high | 8.1 | No | Shopware version 6.7 allows the upload of attacker‑controlled HTML files and serves them as text/html without effective security headers, en... | 2026-10-20 |
| CVE-2026-101292 | high | 8.2 | No | Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). T... | 2026-10-20 |
| CVE-2023-38375 | medium | 6.1 | No | IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScri... | 2026-10-20 |
| CVE-2026-102196 | high | 7.8 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-98154 | high | 7.0 | No | In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_... | 2026-10-20 |
| CVE-2026-102197 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-10-20 |
| CVE-2026-102198 | medium | 5.3 | No | Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network. | 2026-10-20 |
| CVE-2026-102199 | medium | 6.5 | No | Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network. | 2026-10-20 |
| CVE-2026-88164 | high | 8.8 | No | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. | 2026-10-20 |
| CVE-2026-86872 | medium | 5.4 | No | A logic issue was addressed with improved state management. This issue is fixed in Safari 27, visionOS 27, watchOS 27. Processing maliciousl... | 2026-10-20 |
| CVE-2026-71170 | high | 7.8 | No | Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with loc... | 2026-10-20 |
| CVE-2026-64959 | critical | 9.8 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerabi... | 2026-10-20 |
| CVE-2026-112787 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view... | 2026-10-20 |
| CVE-2026-112781 | medium | 6.5 | No | Grav from 2.0.0 before 2.2.2 contains an information disclosure vulnerability that allows page editors to read protected configuration by ad... | 2026-10-20 |