Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108452 | high | 8.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker... | 2026-10-19 |
| CVE-2026-63001 | medium | 4.8 | No | REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_ma... | 2026-10-19 |
| CVE-2026-63000 | medium | 6.4 | No | REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_pa... | 2026-10-19 |
| CVE-2026-108453 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | 2026-10-19 |
| CVE-2026-108454 | medium | 6.5 | No | Buffer over-read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | 2026-10-19 |
| CVE-2026-108455 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information over a network. | 2026-10-19 |
| CVE-2026-90954 | high | 7.8 | No | A flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlik... | 2026-10-19 |
| CVE-2026-52023 | high | 7.5 | No | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the ims_registrar_pcscf module, specifical... | 2026-10-19 |
| CVE-2026-11730 | medium | 5.4 | No | Insufficient session randomness vulnerability in the listed NETGEAR Extender models allows a network-adjacent attacker having network access... | 2026-10-19 |
| CVE-2026-112267 | medium | 6.5 | No | SGLang through 0.5.22 in prefill/decode disaggregation mode contains a server-side request forgery vulnerability that allows unauthenticated... | 2026-10-19 |
| CVE-2026-110885 | medium | 6.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code Injection.This issue af... | 2026-10-19 |
| CVE-2026-111876 | medium | 5.3 | No | A vulnerability was found in alexpasmantier television up to 0.15.9. Affected by this issue is the function Entry::output of the file televi... | 2026-10-19 |
| CVE-2026-110450 | high | 8.0 | No | Nix before 2.35.3 and Lix before 2.95.4 allow privilege escalation via a repair operation because it could destroy and then replace a store... | 2026-10-19 |
| CVE-2026-110365 | medium | 6.5 | No | Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting Incorrectly Configured Access... | 2026-10-19 |
| CVE-2026-107302 | high | 7.5 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the decoder reads the four-byte length of a map32 value... | 2026-10-19 |
| CVE-2026-106123 | medium | 5.5 | No | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.35.0, Con... | 2026-10-19 |
| CVE-2026-104086 | medium | 5.5 | No | 7-Zip before 26.03 contains an uninitialized memory disclosure vulnerability in the SquashFS v4 archive handler (SquashfsHandler.cpp) that a... | 2026-10-19 |
| CVE-2026-108979 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descri... | 2026-10-19 |
| CVE-2026-62171 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-10-19 |
| CVE-2026-107355 | not reported | — | No | Rejected reason: ** This candidate has been removed by an organization. | 2026-10-19 |