Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105660 | not reported | — | No | Improper Validation of Syntactic Correctness of Input vulnerability in mtrudel bandit allows an unauthenticated remote attacker to set conn.... | 2026-10-16 |
| CVE-2026-105659 | not reported | — | No | Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes i... | 2026-10-16 |
| CVE-2026-105236 | not reported | — | No | Improper Certificate Validation vulnerability in the ssl application in Erlang/OTP allows a client that holds a certificate trusted by one S... | 2026-10-16 |
| CVE-2026-103415 | not reported | — | No | When a TLS 1.3 client processes a HelloRetryRequest, it copies the server's cookie into its second ClientHello without checking that the coo... | 2026-10-16 |
| CVE-2026-103414 | not reported | — | No | The GUIX binary resource (theme) loader sizes its arena and populates it in two separate passes that traverse the resource file with indepen... | 2026-10-16 |
| CVE-2026-102631 | not reported | — | No | In authd before 0.7.1, the user identity matching in UpdateUser (internal/users/manager.go) resolves an incoming login by the broker-scoped... | 2026-10-16 |
| CVE-2026-105994 | high | 7.7 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker... | 2026-10-16 |
| CVE-2026-106089 | high | 8.8 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-10-16 |
| CVE-2026-106090 | high | 8.8 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-10-16 |
| CVE-2026-87093 | high | 8.8 | No | Incorrect Permission Assignment for Critical Resource vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before... | 2026-10-16 |
| CVE-2026-105903 | critical | 9.9 | No | ColdFusion is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code exe... | 2026-10-16 |
| CVE-2026-105901 | high | 8.8 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-10-16 |
| CVE-2026-105900 | high | 7.5 | No | ColdFusion is affected by an Improper Input Validation vulnerability that could result in an application denial-of-service. An attacker coul... | 2026-10-16 |
| CVE-2026-96915 | high | 7.8 | No | Integer overflow or wraparound in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-105897 | high | 8.6 | No | ColdFusion is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. Exploitation of this... | 2026-10-16 |
| CVE-2026-102779 | high | 7.3 | No | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extensio... | 2026-10-16 |
| CVE-2026-105751 | high | 7.5 | No | Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0... | 2026-10-16 |
| CVE-2026-105759 | high | 7.5 | No | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, the Rust frontend's track_http_metrics middleware record... | 2026-10-16 |
| CVE-2026-105760 | medium | 5.3 | No | vLLM is an inference and serving engine for large language models. Prior to 0.30.0, a caller can use the request-level media_io_kwargs field... | 2026-10-16 |
| CVE-2026-93590 | high | 7.5 | No | ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer all... | 2026-10-16 |