Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107852 | not reported | — | No | Jexactyl is a customisable game management panel and billing system. Prior to 4.0.5, the POST /api/client/billing/stripe/process endpoint ac... | 2026-10-16 |
| CVE-2026-107851 | medium | 4.3 | No | Contao is an Open Source CMS. From version 5.7.0 until 5.7.12, TableAccessVoter::hasAccessToModule() in core-bundle/src/Security/Voter/DataC... | 2026-10-16 |
| CVE-2026-42270 | high | 7.5 | No | countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and das... | 2026-10-16 |
| CVE-2026-42269 | high | 8.1 | No | countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migr... | 2026-10-16 |
| CVE-2026-107777 | medium | 6.5 | No | Thermo Fisher Torrent Suite Software is vulnerable to a path traversal, which could allow an authenticated attacker to read arbitrary files... | 2026-10-16 |
| CVE-2026-102740 | medium | 5.8 | No | The AsyncHttpClient library allows Java applications to execute HTTP requests and asynchronously process HTTP responses. From 2.0.0 until 2.... | 2026-10-16 |
| CVE-2026-9703 | high | 7.1 | No | Grafana's data source proxy did not apply role-based access control to write requests forwarded to Loki data sources. A user holding only th... | 2026-10-16 |
| CVE-2026-54703 | not reported | — | No | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the _crossnote.updateMarkdown command in... | 2026-10-16 |
| CVE-2026-76083 | not reported | — | No | Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/j... | 2026-10-16 |
| CVE-2026-104103 | high | 8.1 | No | Ludwig is a low-code framework for building custom LLMs, neural networks, and other AI models. Prior to 0.17.8, ludwig.datasets.archives.ext... | 2026-10-16 |
| CVE-2026-102893 | not reported | — | No | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, GenericOpenIdConnectBackend matches the identity pro... | 2026-10-16 |
| CVE-2026-85298 | not reported | — | No | An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integrat... | 2026-10-16 |
| CVE-2026-86607 | medium | 4.3 | No | Internal Application Information Exposure Vulnerability in Hitachi Ops Center Administrator. This issue affects Hitachi Ops Center Administ... | 2026-10-16 |
| CVE-2026-15468 | not reported | — | No | Authorization bypass through User-Controlled key vulnerability in HYPR Passwordless on Windows allows Privilege Escalation. This issue affe... | 2026-10-16 |
| CVE-2026-95502 | medium | 5.3 | No | A Git server that Grafana's Git Sync (provisioning) is configured to use can exhaust Grafana's memory by returning oversized or highly compr... | 2026-10-16 |
| CVE-2026-93294 | medium | 6.3 | No | A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana... | 2026-10-16 |
| CVE-2026-33374 | medium | 6.5 | No | The Prometheus rule conversion API endpoints in Grafana do not limit request body size, allowing authenticated users to trigger unbounded me... | 2026-10-16 |
| CVE-2026-15577 | medium | 6.5 | No | A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its s... | 2026-10-16 |
| CVE-2026-69150 | not reported | — | No | KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB l... | 2026-10-16 |
| CVE-2026-102672 | medium | 6.7 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.10, 41.10.5, and 42.0.... | 2026-10-16 |