Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91236 | critical | 9.8 | No | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected ar... | 2026-10-30 |
| CVE-2026-91237 | high | 7.5 | No | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected ar... | 2026-10-30 |
| CVE-2026-91238 | high | 7.1 | No | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected ar... | 2026-10-30 |
| CVE-2026-91239 | high | 8.8 | No | Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Fabric Layer). Supported versions that are affected ar... | 2026-10-30 |
| CVE-2026-114392 | medium | 5.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets outside their groups v... | 2026-10-30 |
| CVE-2026-114393 | medium | 4.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify tickets outside their gro... | 2026-10-30 |
| CVE-2026-114394 | medium | 4.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content attributed to other us... | 2026-10-30 |
| CVE-2026-114395 | medium | 4.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated users to post messages a... | 2026-10-30 |
| CVE-2026-114396 | high | 7.1 | No | Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to inject code into a Mongo... | 2026-10-30 |
| CVE-2026-114397 | high | 7.4 | No | Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is unset, letting unauthent... | 2026-10-30 |
| CVE-2026-114402 | medium | 4.3 | No | Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in accountsController.uploadImage that allows authen... | 2026-10-30 |
| CVE-2026-101755 | medium | 5.3 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected... | 2026-10-30 |
| CVE-2026-101781 | high | 8.8 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS). Supported versions that... | 2026-10-30 |
| CVE-2026-101771 | high | 8.1 | No | Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs). Supported versions that are affected... | 2026-10-30 |
| CVE-2026-61902 | high | 7.5 | No | Apache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsi... | 2026-10-30 |
| CVE-2026-59229 | high | 8.8 | No | The Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and del... | 2026-10-30 |
| CVE-2026-58064 | high | 7.5 | No | The Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a com... | 2026-10-30 |
| CVE-2026-56388 | critical | 9.1 | No | The Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can re... | 2026-10-30 |
| CVE-2026-56387 | high | 7.5 | No | The RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attac... | 2026-10-30 |
| CVE-2026-54427 | high | 7.5 | No | Uncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested... | 2026-10-30 |