Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-14765 | high | 7.7 | No | Epic Games Unreal Engine versions up to and including 5.8.0 ship with an insecure default configuration for the LaunchURL Blueprint node (UK... | 2026-10-18 |
| CVE-2026-101943 | high | 7.5 | No | An Improper Input Validation vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an... | 2026-10-18 |
| CVE-2026-101942 | high | 7.5 | No | An Improper Handling of Length Parameter Inconsistency vulnerability in the routing protocol daemon (rpd) process of Juniper Networks Junos... | 2026-10-18 |
| CVE-2026-101941 | high | 7.5 | No | A NULL Pointer Dereference vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows a con... | 2026-10-18 |
| CVE-2026-101940 | high | 7.5 | No | A NULL Pointer Dereference vulnerability in the rpd routing daemon of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticat... | 2026-10-18 |
| CVE-2025-14094 | critical | 9.8 | No | A flaw has been found in Edimax BR-6478AC V3 1.0.15. The affected element is the function sub_44CCE4 of the file /boafrm/formSysCmd. This ma... | 2026-10-18 |
| CVE-2025-14093 | critical | 9.8 | No | A vulnerability was detected in Edimax BR-6478AC V3 1.0.15. Impacted is the function sub_416990 of the file /boafrm/formTracerouteDiagnostic... | 2026-10-18 |
| CVE-2025-70819 | medium | 6.3 | No | Zettlab D6 Ultra before 1.7.0 allows mounting /etc/passwd and /etc/shadow in a container via ".." manipulations such as volumes: - ../../../... | 2026-10-18 |
| CVE-2026-63168 | medium | 5.4 | No | Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist u... | 2026-10-18 |
| CVE-2026-63172 | high | 7.1 | No | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to cr... | 2026-10-18 |
| CVE-2026-63165 | high | 8.1 | No | Omnispace Agora Project before 26.10.0 contains a SQL injection vulnerability in the calendar functionality that allows attackers to inject... | 2026-10-18 |
| CVE-2026-63160 | high | 7.4 | No | Omnispace Agora Project before 26.10.0 contains a vulnerability where the persistent remember-me token is stored verbatim server-side, makin... | 2026-10-18 |
| CVE-2026-74047 | medium | 6.5 | No | Wazuh from 4.0.0 before 4.14.8 contains an information disclosure vulnerability that allows low-privileged users with agent:read to retrieve... | 2026-10-18 |
| CVE-2026-74037 | high | 7.2 | No | Wazuh 4.0.0 before 4.14.8 fails to invalidate issued tokens for run_as users with zero static roles, because check_token never consults the... | 2026-10-18 |
| CVE-2026-74032 | medium | 4.3 | No | Wazuh from 4.0.0 before 4.14.8 contains an authorization bypass vulnerability that allows low-privileged authenticated users to read the RBA... | 2026-10-18 |
| CVE-2026-111884 | high | 8.3 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account e-mail in the user co... | 2026-10-18 |
| CVE-2026-111882 | high | 8.1 | No | phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenti... | 2026-10-18 |
| CVE-2026-109675 | medium | 4.3 | No | Frappe Suite before commit 2697564a9c46da6acc614743eaf9915fe5238f4f contains a broken access control vulnerability in the get_mailboxes and... | 2026-10-18 |
| CVE-2026-109670 | medium | 5.4 | No | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a stored cross-site scripting vulnerability caused by record names being ren... | 2026-10-18 |
| CVE-2026-109665 | medium | 4.3 | No | Frappe ERPNext before 15.108.0 and 16.x before 16.18.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-18 |