Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56160 | critical | 9.9 | No | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | 2026-10-24 |
| CVE-2026-15967 | critical | 9.8 | No | Insufficient session expiration vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0... | 2026-10-24 |
| CVE-2026-15966 | critical | 9.8 | No | Permissive cross-domain security policy with untrusted domains vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfe... | 2026-10-24 |
| CVE-2026-10697 | critical | 9.8 | No | Improper Authentication vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 befor... | 2026-10-24 |
| CVE-2026-65906 | critical | 10.0 | No | In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible | 2026-10-24 |
| CVE-2026-64815 | critical | 9.8 | No | In JetBrains IntelliJ IDEA before 2026.2 arbitrary code injection was possible via UI Designer form files | 2026-10-24 |
| CVE-2026-50252 | critical | 9.3 | No | In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increase... | 2026-10-24 |
| CVE-2026-29009 | critical | 9.8 | No | U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFIG_CMD_NFS is enabled... | 2026-10-24 |
| CVE-2026-35035 | critical | 9.0 | No | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support... | 2026-10-24 |
| CVE-2023-29131 | critical | 10.0 | No | A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.5). Affected device consists of an incorrect default value in the... | 2026-10-24 |
| CVE-2023-34844 | critical | 9.8 | No | Play With Docker < 0.0.2 has an insecure CAP_SYS_ADMIN privileged mode causing the docker container to escape. | 2026-10-24 |
| CVE-2021-25827 | critical | 9.8 | No | Emby Server < 4.7.12.0 is vulnerable to a login bypass attack by setting the X-Forwarded-For header to a local IP-address. | 2026-10-24 |
| CVE-2022-44276 | critical | 9.8 | No | In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE. | 2026-10-24 |
| CVE-2023-34416 | critical | 9.8 | No | Memory safety bugs present in Firefox 113, Firefox ESR 102.11, and Thunderbird 102.12. Some of these bugs showed evidence of memory corrupti... | 2026-10-24 |
| CVE-2023-29531 | critical | 9.8 | No | An attacker could have caused an out of bounds memory access using WebGL APIs, leading to memory corruption and a potentially exploitable cr... | 2026-10-24 |
| CVE-2023-29129 | critical | 9.8 | No | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.3 < V1.18.0), Mendix SAML (Mendix 7 compatib... | 2026-10-24 |
| CVE-2023-27407 | critical | 9.9 | No | A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly... | 2026-10-24 |
| CVE-2023-31039 | critical | 9.8 | No | Security vulnerability in Apache bRPC <1.5.0 on all platforms allows attackers to execute arbitrary code via ServerOptions::pid_file. An att... | 2026-10-24 |
| CVE-2023-25207 | critical | 9.8 | No | PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php. | 2026-10-24 |
| CVE-2023-23080 | critical | 9.8 | No | Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda... | 2026-10-24 |