Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108164 | medium | 6.5 | No | Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_co... | 2026-10-16 |
| CVE-2026-108163 | medium | 6.5 | No | Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are inte... | 2026-10-16 |
| CVE-2026-108162 | medium | 6.5 | No | Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP thrott... | 2026-10-16 |
| CVE-2026-108161 | high | 7.5 | No | FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers... | 2026-10-16 |
| CVE-2026-70023 | high | 7.8 | No | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-93649 | high | 7.5 | No | In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (... | 2026-10-16 |
| CVE-2026-89279 | medium | 6.5 | No | Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects au... | 2026-10-16 |
| CVE-2026-85457 | high | 8.1 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overfl... | 2026-10-16 |
| CVE-2026-85215 | high | 7.1 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwo... | 2026-10-16 |
| CVE-2026-79607 | medium | 5.5 | No | During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results... | 2026-10-16 |
| CVE-2026-82632 | low | 3.1 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th... | 2026-10-16 |
| CVE-2026-78335 | medium | 4.2 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th... | 2026-10-16 |
| CVE-2026-108129 | medium | 6.5 | No | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-55252 | not reported | — | No | OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0... | 2026-10-16 |
| CVE-2026-19553 | not reported | — | No | ssl.SSLContext.wrap_bio() didn't require the server_hostname argument to not be None if ssl.SSLContext.check_hostname was set. Due to a miss... | 2026-10-16 |
| CVE-2026-111722 | high | 8.1 | No | LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other... | 2026-10-16 |
| CVE-2026-111717 | medium | 4.3 | No | Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other... | 2026-10-16 |
| CVE-2026-111712 | medium | 6.5 | No | Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected... | 2026-10-16 |
| CVE-2026-111707 | medium | 5.3 | No | 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' cha... | 2026-10-16 |
| CVE-2026-111702 | high | 7.5 | No | ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other us... | 2026-10-16 |