Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-3960 | critical | 9.8 | No | A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9... | 2026-10-26 |
| CVE-2026-5935 | critical | 9.8 | No | IBM Total Storage Service Console (TSSC) / TS4500 IMC 9.2, 9.3, 9.4, 9.5, 9.6 TSSC/IMC could allow an unauthenticated user to execute arbitr... | 2026-10-26 |
| CVE-2026-41304 | critical | 9.8 | No | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constr... | 2026-10-26 |
| CVE-2026-39861 | critical | 10.0 | No | Claude Code is an agentic coding tool. Prior to version 2.1.64, Claude Code's sandbox did not prevent sandboxed processes from creating syml... | 2026-10-26 |
| CVE-2026-32311 | critical | 9.8 | No | Flowsint is an open-source OSINT graph exploration tool designed for cybersecurity investigation, transparency, and verification. Flowsint a... | 2026-10-26 |
| CVE-2026-41153 | critical | 9.8 | No | In JetBrains Junie before 252.549.29 command execution was possible via malicious project file | 2026-10-26 |
| CVE-2026-6290 | critical | 9.1 | No | Velociraptor versions prior to 0.76.3 contain a vulnerability in the query() plugin which allows access to all orgs with the user's current... | 2026-10-26 |
| CVE-2026-33808 | critical | 9.1 | No | Impact@fastify/express v4.0.4 and earlier fails to normalize URLs before passing them to Express middleware when Fastify router normalizatio... | 2026-10-26 |
| CVE-2026-27246 | critical | 9.3 | No | Adobe Connect versions 2025.3, 12.10 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exp... | 2026-10-26 |
| CVE-2026-40315 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. Prior to 4.5.133, there is an SQL identifier injection vulnerability in SQLiteConversationStore whe... | 2026-10-26 |
| CVE-2026-5936 | critical | 9.8 | No | An attacker can control a server-side HTTP request by supplying a crafted URL, causing the server to initiate requests to arbitrary destinat... | 2026-10-26 |
| CVE-2026-40446 | critical | 9.8 | No | Access of resource using incompatible type ('type confusion') vulnerability in Samsung Open Source Escargot allows Pointer Manipulation.This... | 2026-10-26 |
| CVE-2026-4149 | critical | 9.8 | No | Sonos Era 300 SMB Response Out-Of-Bounds Access Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute a... | 2026-10-26 |
| CVE-2026-40189 | critical | 9.8 | No | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism f... | 2026-10-26 |
| CVE-2026-34987 | critical | 9.9 | No | Wasmtime is a runtime for WebAssembly. From 25.0.0 to before 36.0.7, 42.0.2, and 43.0.1, Wasmtime with its Winch (baseline) non-default comp... | 2026-10-26 |
| CVE-2026-5841 | critical | 9.8 | No | A weakness has been identified in Tenda i3 1.0.0.6(2204). The affected element is the function R7WebsSecurityHandler of the component HTTP H... | 2026-10-26 |
| CVE-2026-28808 | critical | 9.8 | No | Incorrect Authorization vulnerability in Erlang OTP (inets modules) allows unauthenticated access to CGI scripts protected by directory rule... | 2026-10-26 |
| CVE-2026-34208 | critical | 10.0 | No | SandboxJS is a JavaScript sandboxing library. Prior to 0.8.36, SandboxJS blocks direct assignment to global objects (for example Math.random... | 2026-10-26 |
| CVE-2026-5244 | critical | 9.8 | No | A vulnerability has been found in Cesanta Mongoose up to 7.20. This affects the function mg_tls_recv_cert of the file mongoose.c of the comp... | 2026-10-26 |
| CVE-2026-34569 | critical | 9.0 | No | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support... | 2026-10-26 |