Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107805 | high | 7.5 | No | Nginx UI is a web user interface for the Nginx web server. From 2.5.0 until 2.6.0, the node-signature authentication path performs temporary... | 2026-10-20 |
| CVE-2026-107806 | high | 7.2 | No | Nginx UI is a web user interface for the Nginx web server. From 2.3.8 until 2.5.0, an authenticated administrator with an active secure sess... | 2026-10-20 |
| CVE-2026-109678 | medium | 6.5 | No | FreeRDP 3.0.0-beta1 before 3.32.0, when built with verbose WinPR assertions and using smartcard emulation, has a reachable assertion: the em... | 2026-10-20 |
| CVE-2026-109679 | medium | 5.3 | No | FreeRDP 3.0.0-beta4 before 3.32.0 contains a NULL pointer dereference in arm_handle_request_ok when an ARM endpoint returns an empty HTTP 20... | 2026-10-20 |
| CVE-2026-109680 | medium | 6.5 | No | FreeRDP 3.18.0 before 3.32.0 has a heap-based out-of-bounds write in freerdp_interruptible_get_line, which shrinks the buffer to 32 bytes wh... | 2026-10-20 |
| CVE-2026-97160 | high | 8.8 | No | Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-97161 | high | 7.5 | No | Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-97627 | high | 7.2 | No | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to... | 2026-10-20 |
| CVE-2026-75753 | not reported | — | No | Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send specific commands via HTTP... | 2026-10-20 |
| CVE-2026-17518 | not reported | — | No | Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to corrupt device operations... | 2026-10-20 |
| CVE-2026-71253 | critical | 9.8 | No | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Johnzon. ClassConverter loads &... | 2026-10-20 |
| CVE-2026-12254 | not reported | — | No | Netskope is notified about a potential gap in its agent (NSClient) where a system with Netskope Client while connecting to an access point w... | 2026-10-20 |
| CVE-2026-113714 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, download_wheel() writes package-index downloads di... | 2026-10-20 |
| CVE-2026-113401 | medium | 6.5 | No | Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | 2026-10-20 |
| CVE-2026-113400 | medium | 5.4 | No | Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1 and Thunderbird 158.0.1. | 2026-10-20 |
| CVE-2026-110725 | low | 3.7 | No | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4... | 2026-10-20 |
| CVE-2026-112991 | not reported | — | No | The html_to_markdown expansion module in MISP Modules contains a server-side request forgery (SSRF) vulnerability in its is_safe_url() URL v... | 2026-10-20 |
| CVE-2026-112368 | high | 7.5 | No | An uncontrolled recursion weakness in the BSON decoding logic of the MongoDB PHP driver may allow an unauthenticated party who can supply cr... | 2026-10-20 |
| CVE-2026-110306 | medium | 6.1 | No | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4... | 2026-10-20 |
| CVE-2026-109831 | medium | 5.4 | No | UnRTF by GNU Project is vulnerable to out-of-bounds write. If a user opens an RTF file crafted by an attacker, it may lead to a denial-of-se... | 2026-10-20 |