Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2020-37284 | medium | 6.1 | No | Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts... | 2026-10-28 |
| CVE-2018-25438 | high | 7.5 | No | Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that allows remote attack... | 2026-10-28 |
| CVE-2026-88152 | high | 7.8 | No | Use after free in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-98099 | medium | 4.7 | No | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcu_assign_pointer() for __rcu list updates Several p... | 2026-10-28 |
| CVE-2023-54366 | high | 8.8 | No | SurrealDB before 1.0.1 sets default table permissions to FULL instead of NONE, allowing SELECT, CREATE, UPDATE, and DELETE operations on tab... | 2026-10-28 |
| CVE-2023-37524 | high | 7.8 | No | HCL Traveler for Microsoft Outlook (HTMO) is susceptible to vulnerabilities due to .NET Framework 4.5 being out of service. Since .NET Frame... | 2026-10-28 |
| CVE-2023-54357 | high | 7.5 | No | Joomla com_booking component 2.4.9 contains an information disclosure vulnerability that allows unauthenticated attackers to enumerate user... | 2026-10-28 |
| CVE-2023-24215 | critical | 9.1 | No | Incorrect access control in the /uci/get/ endpoint of NOVUS AirGate 4G firmware v1.1.16 allows unauthenticated attackers to obtain administr... | 2026-10-28 |
| CVE-2023-31317 | not reported | — | No | Improper restriction of operations within the bounds of a memory buffer in the AMD secure processer (ASP) could allow an attacker to read or... | 2026-10-28 |
| CVE-2023-31316 | not reported | — | No | Improperly preserved integrity of hardware configuration state during a power save/restore operation in the AMD Secure Processor (ASP) could... | 2026-10-28 |
| CVE-2023-31309 | not reported | — | No | Improper validation in Power Management Firmware (PMFW) may allow an attacker with privileges to pass malformed workload arguments when expo... | 2026-10-28 |
| CVE-2023-30059 | medium | 5.4 | No | An insecure direct object reference in MK-Auth 23.01K4.9 allows attackers to access and send support calls for other users via manipulation... | 2026-10-28 |
| CVE-2023-27753 | high | 8.0 | No | An arbitrary file upload vulnerability in MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a crafted PHP file. | 2026-10-28 |
| CVE-2023-46453 | critical | 9.8 | No | Certain GL.iNet devices with 4.x firmware allow authentication bypass (resulting in administrative control of the device) via a username tha... | 2026-10-28 |
| CVE-2023-47268 | medium | 5.3 | No | In libslic3r/GCode/PostProcessor.cpp in Prusa PrusaSlicer through 2.6.1, a crafted 3mf project file can execute arbitrary code on a host whe... | 2026-10-28 |
| CVE-2023-42346 | high | 7.5 | No | Alkacon OpenCms before 16 allows XXE when the refers to an external host. | 2026-10-28 |
| CVE-2023-42345 | medium | 6.1 | No | A Cross Site Scripting vulnerability in Alkacon OpenCms before 16 exists via updateModelGroups.jsp. | 2026-10-28 |
| CVE-2023-42344 | high | 7.3 | No | Alkacon OpenCms before 10.5.1 allows remote unauthenticated attackers to obtain sensitive information via a cmis-online/query XXE attack on... | 2026-10-28 |
| CVE-2023-42343 | medium | 6.1 | No | A Cross Site Scripting vulnerability in Alkacon OpenCms before 10.5.1 exists via cmis-online/type. | 2026-10-28 |
| CVE-2023-54349 | medium | 6.1 | No | AmazCart CMS 3.4 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts b... | 2026-10-28 |