Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76305 | medium | 6.5 | No | In Splunk SOAR versions below 8.7.0, an authenticated user who does not hold a role with permission to view apps could download an archive o... | 2026-10-28 |
| CVE-2026-76301 | critical | 9.8 | No | As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security revie... | 2026-10-28 |
| CVE-2026-114661 | high | 8.5 | No | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user t... | 2026-10-28 |
| CVE-2026-114657 | medium | 5.7 | No | Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic crede... | 2026-10-28 |
| CVE-2026-114640 | high | 8.7 | No | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards cl... | 2026-10-28 |
| CVE-2026-114636 | high | 8.7 | No | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated f... | 2026-10-28 |
| CVE-2026-114577 | high | 7.3 | No | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the... | 2026-10-28 |
| CVE-2026-114714 | medium | 5.3 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. Wi... | 2026-10-28 |
| CVE-2026-114574 | medium | 4.3 | No | A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of... | 2026-10-28 |
| CVE-2026-96778 | high | 8.8 | No | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker()... | 2026-10-28 |
| CVE-2026-96641 | medium | 6.5 | No | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances agains... | 2026-10-28 |
| CVE-2026-114439 | high | 7.3 | No | A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin... | 2026-10-28 |
| CVE-2026-96640 | high | 7.5 | No | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages gra... | 2026-10-28 |
| CVE-2026-114438 | medium | 4.2 | No | A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution. When this action is orde... | 2026-10-28 |
| CVE-2026-89035 | high | 7.4 | No | MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authe... | 2026-10-28 |
| CVE-2026-114382 | critical | 10.0 | No | A security flaw has been discovered in TOTOLINK EX200 5.2.3c.7200. This affects the function setStaticDhcpConfig of the file /cgi-bin/cstecg... | 2026-10-28 |
| CVE-2026-114379 | medium | 5.4 | No | A flaw has been found in EKKOLearnAI ekko-studio up to 1.0.6. This vulnerability affects the function saveGeneratedImages of the file packag... | 2026-10-28 |
| CVE-2026-114376 | medium | 6.3 | No | A weakness has been identified in leomoon-studios wiki-go up to 1.9.1. Affected by this vulnerability is the function SaveHandler/SourceHand... | 2026-10-28 |
| CVE-2026-114362 | medium | 6.3 | No | A flaw has been found in HarnessRouter up to 0.31.12. This impacts an unknown function of the file gateway/app.py of the component Targets T... | 2026-10-28 |
| CVE-2026-114267 | high | 7.3 | No | A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endp... | 2026-10-28 |