Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76284 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-16 |
| CVE-2026-76283 | high | 7.6 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-16 |
| CVE-2026-76282 | high | 8.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-16 |
| CVE-2026-75505 | not reported | — | No | EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission c... | 2026-10-16 |
| CVE-2026-63442 | high | 8.1 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts ca... | 2026-10-16 |
| CVE-2026-62679 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the... | 2026-10-16 |
| CVE-2026-63354 | critical | 9.6 | No | Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the T... | 2026-10-16 |
| CVE-2026-59241 | high | 8.8 | No | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC... | 2026-10-16 |
| CVE-2026-55842 | medium | 5.4 | No | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/... | 2026-10-16 |
| CVE-2026-57568 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to sto... | 2026-10-16 |
| CVE-2026-53582 | high | 7.1 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate... | 2026-10-16 |
| CVE-2026-55154 | medium | 5.4 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.p... | 2026-10-16 |
| CVE-2026-12272 | medium | 5.3 | No | The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all... | 2026-10-16 |
| CVE-2026-46694 | medium | 6.5 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record... | 2026-10-16 |
| CVE-2026-21119 | not reported | — | No | Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-o... | 2026-10-16 |
| CVE-2026-111387 | medium | 6.5 | No | Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party cred... | 2026-10-16 |
| CVE-2026-111278 | medium | 5.3 | No | NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the e... | 2026-10-16 |
| CVE-2026-111229 | high | 7.2 | No | pfSense CE 2.7.0 through 2.9.0 contains a command injection vulnerability in services_captiveportal_hasync.php that allows users with only t... | 2026-10-16 |
| CVE-2026-111224 | high | 7.5 | No | pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authentic... | 2026-10-16 |
| CVE-2026-111157 | medium | 6.1 | No | SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd sa... | 2026-10-16 |