Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58462 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-109222 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descri... | 2026-10-16 |
| CVE-2026-68764 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-104703 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-104841 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-18524 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-103755 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-100197 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-62181 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-10-16 |
| CVE-2026-93346 | medium | 5.3 | No | Wazuh from 4.0.0 before 4.14.8 contains a race condition in API login throttling that allows unauthenticated attackers to bypass max_login_a... | 2026-10-16 |
| CVE-2026-85114 | high | 7.5 | No | A vulnerability has been identified in .NET Client Library for SIMATIC S7 Webserver API (All versions < V3.3.61). Affected applications do n... | 2026-10-16 |
| CVE-2026-77361 | medium | 4.7 | No | obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, read access-control list (ACL) che... | 2026-10-16 |
| CVE-2026-74040 | critical | 9.1 | No | Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowin... | 2026-10-16 |
| CVE-2026-74033 | medium | 6.1 | No | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_lists() and delete_list_file() CDB list handlers that allo... | 2026-10-16 |
| CVE-2026-111721 | medium | 5.4 | No | Open WES through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users to modify other warehouses' stock reco... | 2026-10-16 |
| CVE-2026-111716 | medium | 5.4 | No | Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and modify other departments'... | 2026-10-16 |
| CVE-2026-111711 | critical | 9.8 | No | Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's user_ok() function, wh... | 2026-10-16 |
| CVE-2026-55376 | high | 8.8 | No | Heym builds and runs agentic systems and business-process automations on self-hosted infrastructure. Prior to 0.0.40, an authenticated user... | 2026-10-16 |
| CVE-2026-53709 | critical | 9.8 | No | MCP Context Forge is an MCP gateway and administrative platform. Prior to 1.0.2, mcpgateway/config.py and .env.example ship a known JWT_SECR... | 2026-10-16 |
| CVE-2026-111706 | high | 7.5 | No | 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that allows unauthenticated at... | 2026-10-16 |