Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94482 | not reported | — | No | Next.js is a React framework for building full-stack web applications. From 13.0.0 until 15.5.28 and 16.4.1, crafted requests targeting App... | 2026-10-30 |
| CVE-2026-93471 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an unauthenticated attacker to exh... | 2026-10-30 |
| CVE-2026-90437 | high | 7.2 | No | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field / Rich-Text Paragra... | 2026-10-30 |
| CVE-2026-89435 | high | 8.8 | No | The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Arbitrary... | 2026-10-30 |
| CVE-2026-92202 | high | 7.8 | No | Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attac... | 2026-10-30 |
| CVE-2026-86696 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated attacker to exhaust t... | 2026-10-30 |
| CVE-2026-79868 | critical | 9.6 | No | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent exis... | 2026-10-30 |
| CVE-2026-79867 | critical | 9.6 | No | Authentication bypass vulnerabilities in the affected interface of AOS-8 could allow an unauthenticated adjacent attacker to circumvent exis... | 2026-10-30 |
| CVE-2026-79866 | critical | 9.6 | No | An unauthenticated path traversal vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation of this vulnerability could al... | 2026-10-30 |
| CVE-2026-79865 | critical | 9.6 | No | A memory corruption vulnerability in the affected interface of AOS-10 could allow an unauthenticated adjacent attacker to achieve remote cod... | 2026-10-30 |
| CVE-2026-79864 | critical | 9.6 | No | Command injection vulnerabilities exist in the affected interface of AOS-10 that could allow an unauthenticated adjacent attacker to perform... | 2026-10-30 |
| CVE-2026-79863 | critical | 9.6 | No | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arb... | 2026-10-30 |
| CVE-2026-79862 | critical | 9.6 | No | Buffer overflow vulnerabilities in the affected interface of AOS-10 or AOS-8 could allow an unauthenticated adjacent attacker to execute arb... | 2026-10-30 |
| CVE-2026-79861 | critical | 9.8 | No | There is a command injection vulnerability in AOS-10 that could lead to unauthenticated remote code execution by sending specially crafted P... | 2026-10-30 |
| CVE-2026-79860 | critical | 9.8 | No | Buffer overflow vulnerabilities exist in an underlying service of AOS-8 that could lead to unauthenticated remote code execution by sending... | 2026-10-30 |
| CVE-2026-79859 | critical | 9.8 | No | Buffer overflow vulnerabilities exist in the affected interface of AOS-8 that could lead to unauthenticated remote code execution. Successfu... | 2026-10-30 |
| CVE-2026-76529 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-30 |
| CVE-2026-76408 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-30 |
| CVE-2026-76012 | high | 7.5 | No | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code Execution in all version... | 2026-10-30 |
| CVE-2026-66026 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-30 |