Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56449 | high | 7.5 | No | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_proxy_html with crafted HTTP response bodies. This issue affects Apache HTTP... | 2026-10-21 |
| CVE-2026-16487 | not reported | — | No | Rejected reason: Red Hat Product Security has determined that this is not a vulnerability in bootc or containers-common. bootc fetches image... | 2026-10-21 |
| CVE-2026-110927 | not reported | — | No | Rejected reason: CVE-2026-110927 has been marked as a duplicate of CVE-2026-106585. | 2026-10-21 |
| CVE-2026-110924 | not reported | — | No | Rejected reason: CVE-2026-110924 has been marked as a duplicate of CVE-2026-106553. | 2026-10-21 |
| CVE-2026-110926 | not reported | — | No | Rejected reason: CVE-2026-110926 has been marked as a duplicate of CVE-2026-106582. | 2026-10-21 |
| CVE-2026-110925 | not reported | — | No | Rejected reason: CVE-2026-110925 has been marked as a duplicate of CVE-2026-106583. | 2026-10-21 |
| CVE-2026-110923 | not reported | — | No | Rejected reason: CVE-2026-110923 has been marked as a duplicate of CVE-2026-106552. | 2026-10-21 |
| CVE-2026-86471 | not reported | — | No | An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary... | 2026-10-21 |
| CVE-2026-28328 | high | 8.8 | No | SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow low-privileged users to access... | 2026-10-21 |
| CVE-2026-76740 | high | 7.2 | No | A security vulnerability in HPE Compute Scale-up Server 3200 and 3250 platforms, Superdome Flex and Superdome Flex 280 servers could be expl... | 2026-10-21 |
| CVE-2026-102438 | not reported | — | No | An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code with SYSTEM privileges... | 2026-10-21 |
| CVE-2026-105453 | high | 8.4 | No | IBM Sterling Connect Direct for Unix 6.3.0.0 through 6.3.0.7 and 6.4.0.0 through 6.4.0.6 could allow a local attacker to gain elevated privi... | 2026-10-21 |
| CVE-2026-92262 | critical | 9.9 | No | MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the... | 2026-10-21 |
| CVE-2026-95859 | not reported | — | No | libp2p-rust is the official Rust language implementation of the libp2p networking stack. Prior to 0.49.5, Gossipsub GRAFT control-message ha... | 2026-10-21 |
| CVE-2026-92263 | high | 7.2 | No | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, the api/admin/backup/restore endpoint in... | 2026-10-21 |
| CVE-2026-111609 | low | 3.8 | No | PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal or subscription mana... | 2026-10-21 |
| CVE-2026-86009 | not reported | — | No | Mailu is a mail server distributed as a set of Docker images. Prior to f05aeb8322e2f61096af6b089d61ba6f40587d96, domain managers can enable... | 2026-10-21 |
| CVE-2026-49868 | critical | 9.8 | No | RIOT is an open-source microcontroller operating system designed for Internet of Things devices and other embedded systems. Prior to 2026.07... | 2026-10-21 |
| CVE-2026-48741 | high | 7.5 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. P... | 2026-10-21 |
| CVE-2026-44977 | critical | 9.0 | No | countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api... | 2026-10-21 |