Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104085 | high | 8.8 | No | odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary... | 2026-10-29 |
| CVE-2026-104436 | low | 3.7 | No | Zebra before 4.5.0 contains an uncontrolled resource consumption vulnerability that allows remote P2P peers to exhaust blocking-pool threads... | 2026-10-29 |
| CVE-2026-102484 | medium | 6.4 | No | Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the Telephone JJY time sou... | 2026-10-29 |
| CVE-2026-102483 | high | 7.5 | No | Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request with excess NTS Cookie... | 2026-10-29 |
| CVE-2026-101987 | medium | 6.5 | No | An Improper Validation of Specified Quantity in Input vulnerability in the routing daemon (rpd) of Juniper Networks Junos OS and Junos OS Ev... | 2026-10-29 |
| CVE-2026-100834 | medium | 5.9 | No | http4k's Digest authentication module (org.http4k:http4k-security-digest) before versions 6.48.0.0, 5.42.0.0 and 4.51.0.0 defaults the nonce... | 2026-10-29 |
| CVE-2025-71398 | high | 7.6 | No | SurrealDB before 2.2.2 fails to validate HTTP redirects in http functions, allowing authenticated users to bypass deny-net restrictions by r... | 2026-10-29 |
| CVE-2025-71397 | medium | 6.5 | No | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 allows authenticated users with OWNER or EDITOR permissions (at the root,... | 2026-10-29 |
| CVE-2025-71396 | medium | 6.5 | No | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 does not enforce a default execution-time limit on embedded JavaScript sc... | 2026-10-29 |
| CVE-2025-71395 | medium | 6.5 | No | SurrealDB versions before 2.2.2 contain a memory exhaustion vulnerability in the string::replace function that fails to restrict resulting s... | 2026-10-29 |
| CVE-2025-71394 | medium | 4.3 | No | SurrealDB versions before 2.2.2 contain a local file read vulnerability in the DEFINE ANALYZER statement that allows authenticated users to... | 2026-10-29 |
| CVE-2026-100725 | medium | 6.5 | No | http4k (Maven artifact org.http4k:http4k-core) before 6.48.0.0, 5.42.0.0, and 4.51.0.0 ships a BasicCookieStorage (client-side cookie store... | 2026-10-29 |
| CVE-2026-100724 | medium | 5.4 | No | http4k (Maven package org.http4k:http4k-core) before 6.49.0.0, 5.42.0.0 and 4.51.0.0 uses substring (Contains) matching on the Host header b... | 2026-10-29 |
| CVE-2026-100709 | high | 7.5 | No | Froxlor through 2.3.10 stores only a numeric user ID in remembered-2FA tokens (panel_2fa_tokens) without recording the account namespace, an... | 2026-10-29 |
| CVE-2025-71393 | medium | 6.5 | No | SurrealDB before 2.2.2 with scripting enabled fails to properly enforce recursion limits when native functions contain embedded JavaScript t... | 2026-10-29 |
| CVE-2025-71392 | high | 8.0 | No | SurrealDB before 2.0.5, 2.1.x before 2.1.5, and 2.2.x before 2.2.2 fails to properly escape table and field names in the command-line export... | 2026-10-29 |
| CVE-2025-71391 | medium | 6.5 | No | SurrealDB versions before 2.2.2 contain an uncaught exception vulnerability in the net module that allows authenticated users to crash the d... | 2026-10-29 |
| CVE-2025-71381 | medium | 6.5 | No | Hono before 4.10.3 contains a flaw in its CORS middleware: when the origin is not set to "*", the middleware copies the Vary header from the... | 2026-10-29 |
| CVE-2025-71334 | critical | 9.8 | No | Flowise before 3.0.6 contains an arbitrary file access vulnerability due to missing validation that the chatflowId and chatId parameters are... | 2026-10-29 |
| CVE-2025-34506 | high | 8.8 | No | WBCE CMS version 1.6.3 and prior contains an authenticated remote code execution vulnerability that allows administrators to upload maliciou... | 2026-10-29 |