Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105016 | critical | 9.8 | No | Heap-based buffer overflow in Microsoft QUIC allows an unauthorized attacker to execute code over a network. | 2026-10-22 |
| CVE-2026-47606 | critical | 9.1 | No | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an absolute path traversal. A successful exp... | 2026-10-22 |
| CVE-2026-73373 | critical | 9.8 | No | Joomla! Core - [20260810] - Unrestricted uploads of SHTML files in Joomla 1.0.0-5.4.7, 6.0.0-6.1.2 - The default list of dangerous files did... | 2026-10-22 |
| CVE-2026-6554 | high | 7.5 | No | libpcap BPF interpreter treats the offset in the 'ja L' BPF instruction as a signed integer to implement looping via backward jumps, but it... | 2026-10-22 |
| CVE-2026-55644 | not reported | — | No | Element X iOS is a Matrix iOS Client provided by Element. Element X iOS before version 26.05.0 fails to check the URL allowlist when parsing... | 2026-10-22 |
| CVE-2026-11319 | medium | 6.2 | No | TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that a... | 2026-10-22 |
| CVE-2026-112780 | high | 8.8 | No | Grav from 2.0.15 before 2.2.2 contains an allowlist bypass vulnerability that allows page editors to call arbitrary public static methods by... | 2026-10-22 |
| CVE-2026-112775 | high | 7.5 | No | Craft CMS from 5.0.0 before 5.11.0 contains an authentication bypass vulnerability that allows attackers to reuse verification codes because... | 2026-10-22 |
| CVE-2026-112302 | medium | 6.3 | No | A weakness has been identified in kiwilan php-archive up to 2.3.02. This affects the function ArchiveZip::extract of the file src/Readers/Ar... | 2026-10-22 |
| CVE-2026-112770 | high | 8.8 | No | Craft CMS 4.x before 4.18.8 and 5.x before 5.11.0 contains a remote code execution vulnerability in the Twig group filter, which invokes non... | 2026-10-22 |
| CVE-2026-112297 | medium | 4.3 | No | A flaw has been found in ptbsare anx-calibre-manager up to 1.13.12. The impacted element is the function LLMClient.chat of the file blueprin... | 2026-10-22 |
| CVE-2026-112249 | low | 2.4 | No | A vulnerability was detected in grandnode grandnode2 up to 2.3.0. Affected is the function Html.Raw of the file src/Web/Grand.Web/Views/Prod... | 2026-10-22 |
| CVE-2026-112193 | low | 3.7 | No | A vulnerability was detected in Webkul Aureus ERP up to 1.6.0. Impacted is an unknown function of the file plugins/webkul/security/src/Filam... | 2026-10-22 |
| CVE-2026-111749 | not reported | — | No | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, Host-Only scope on an existing parent-domai... | 2026-10-22 |
| CVE-2026-111063 | not reported | — | No | AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, the Secure attribute for a shared cookie is... | 2026-10-22 |
| CVE-2026-96563 | medium | 6.4 | No | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stm_f_s'... | 2026-10-22 |
| CVE-2024-21762 | critical | 9.8 | Listed | A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, Fort... | 2026-10-22 |
| CVE-2026-91541 | medium | 6.5 | No | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects). The supported... | 2026-10-22 |
| CVE-2026-91453 | medium | 5.3 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightwe... | 2026-10-22 |
| CVE-2026-91452 | medium | 5.3 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Network... | 2026-10-22 |