Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69651 | high | 7.5 | No | Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. | 2026-10-22 |
| CVE-2026-66822 | medium | 5.9 | No | Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. | 2026-10-22 |
| CVE-2026-58280 | high | 7.5 | No | Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. | 2026-10-22 |
| CVE-2026-113583 | medium | 6.1 | No | Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary... | 2026-10-22 |
| CVE-2026-113411 | medium | 6.3 | No | A vulnerability was found in Nerimity Desktop up to 2.2.2. Affected by this issue is the function shell.openExternal of the file src/mainWin... | 2026-10-22 |
| CVE-2026-113394 | high | 7.4 | No | A vulnerability was identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. Impacted is the function setSWMProfile of the file /cgi-bin/mainf... | 2026-10-22 |
| CVE-2026-113390 | critical | 9.9 | No | A flaw has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this issue is the function sub_182B0 of the file /cgi-bin/main... | 2026-10-22 |
| CVE-2026-113384 | medium | 4.3 | No | A flaw has been found in Optimal IdM OptimalCloud 5.0. This vulnerability affects unknown code of the file /v5.0/social. Executing a manipul... | 2026-10-22 |
| CVE-2026-113354 | medium | 6.5 | No | Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit permission to read files t... | 2026-10-22 |
| CVE-2026-113386 | high | 7.1 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit t... | 2026-10-22 |
| CVE-2026-112940 | high | 7.1 | No | filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock let SQLite reopen the database and side file... | 2026-10-22 |
| CVE-2026-112934 | medium | 6.1 | No | filelock is a platform-independent file lock for Python. From 4.0.0 until 4.2.1, SoftReadWriteLock refreshes holder records by name, allowin... | 2026-10-22 |
| CVE-2026-113349 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent() that allows authentic... | 2026-10-22 |
| CVE-2026-111765 | high | 7.5 | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final,... | 2026-10-22 |
| CVE-2026-111761 | medium | 5.8 | No | A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common... | 2026-10-22 |
| CVE-2026-112783 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-... | 2026-10-22 |
| CVE-2026-112370 | critical | 9.9 | No | A vulnerability was found in H3C Magic NX15 100R017. This issue affects the function sub_416874 of the file /usr/bin/usrlist. Performing a m... | 2026-10-22 |
| CVE-2026-109444 | critical | 9.8 | No | OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without co... | 2026-10-22 |
| CVE-2026-109440 | high | 8.8 | No | LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to execute shell commands or P... | 2026-10-22 |
| CVE-2026-109468 | high | 7.5 | No | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-22 |