Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-41473 | critical | 9.1 | No | CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthe... | 2026-10-26 |
| CVE-2026-41415 | critical | 9.1 | No | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, there is an out-of-bounds read when pars... | 2026-10-26 |
| CVE-2026-41274 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the GraphCypherQAChain node forward... | 2026-10-26 |
| CVE-2026-33819 | critical | 9.8 | No | Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. | 2026-10-26 |
| CVE-2026-26150 | critical | 10.0 | No | Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. | 2026-10-26 |
| CVE-2026-41267 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, an improper mass assignment (JSON i... | 2026-10-26 |
| CVE-2026-41264 | critical | 9.8 | No | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, the specific flaw exists within the... | 2026-10-26 |
| CVE-2026-41247 | critical | 9.8 | No | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injecti... | 2026-10-26 |
| CVE-2026-41211 | critical | 10.0 | No | Vite+ is a unified toolchain and entry point for web development. Prior to version 0.1.17, `downloadPackageManager()` accepts an untrusted `... | 2026-10-26 |
| CVE-2026-26354 | critical | 9.8 | No | Dell PowerProtect Data Domain with Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.6, LTS2025 release version... | 2026-10-26 |
| CVE-2026-33608 | critical | 9.8 | No | An attacker can send a notify request that causes a new secondary domain to be added to the bind backend, but causes said backend to update... | 2026-10-26 |
| CVE-2026-33598 | critical | 9.1 | No | A cached crafted response can cause an out-of-bounds read if custom Lua code calls getDomainListByAddress() or getAddressListByDomain() on a... | 2026-10-26 |
| CVE-2026-6023 | critical | 9.8 | No | In Progress® Telerik® UI for AJAX versions 2024.4.1114 through 2026.1.421, the RadFilter control is vulnerable to insecure deserialization w... | 2026-10-26 |
| CVE-2026-41144 | critical | 9.8 | No | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to versio... | 2026-10-26 |
| CVE-2026-5845 | critical | 9.6 | No | An improper authorization vulnerability in scoped user-to-server (ghu_) token authorization in GitHub Enterprise Server allows an authentica... | 2026-10-26 |
| CVE-2026-40910 | critical | 9.1 | No | frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUse... | 2026-10-26 |
| CVE-2026-40892 | critical | 9.8 | No | PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_... | 2026-10-26 |
| CVE-2026-6644 | critical | 9.1 | No | A command injection vulnerability was found in the PPTP VPN Clients on the ADM. The vulnerability allows an administrative user to break out... | 2026-10-26 |
| CVE-2026-6643 | critical | 9.9 | No | A stack-based buffer overflow vulnerability was found in the VPN Clients on the ADM. The issue stems from the use of unbounded sscanf() and... | 2026-10-26 |
| CVE-2026-40487 | critical | 9.0 | No | Postiz is an AI social media scheduling tool. Prior to version 2.21.6, a file upload validation bypass allows any authenticated user to uplo... | 2026-10-26 |