Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107571 | high | 7.8 | No | Incorrect default permissions in the Windows installer of Progressive Robot hMailServer 6.0.0 through 6.3.6 allow a local authenticated user... | 2026-10-20 |
| CVE-2026-107188 | critical | 9.6 | No | A user can upload export reports with any file contents and specify any contents. JSP code can be uploaded, JSPX can be specified as the fil... | 2026-10-20 |
| CVE-2026-107187 | high | 8.5 | No | A user can access any database details, such as usernames and passwords by sending a DWR request with a specified workflow rule. The authent... | 2026-10-20 |
| CVE-2026-107186 | high | 8.6 | No | An unauthenticated user can send a DWR request with isPasswordUppercase as one call method and the next call method can be set to a run work... | 2026-10-20 |
| CVE-2026-107569 | high | 7.5 | No | Unchecked input for a loop condition in Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attacker to stop t... | 2026-10-20 |
| CVE-2026-107568 | medium | 6.5 | No | Missing authorization in the Sieve notify action (6.2.22 through 6.3.6) and in the mail-rule Reply action (6.0.0 through 6.3.6) of Progressi... | 2026-10-20 |
| CVE-2026-107567 | high | 7.5 | No | Use of a less trusted source in the DKIM signing of Progressive Robot hMailServer 6.0.0 through 6.3.6 allows a remote unauthenticated attack... | 2026-10-20 |
| CVE-2026-107566 | medium | 6.5 | No | Missing authorization in the Sieve editheader action (6.2.22 through 6.3.6) and in the mail-rule Set header value action (6.0.0 through 6.3.... | 2026-10-20 |
| CVE-2026-105941 | high | 8.1 | No | The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation,... | 2026-10-20 |
| CVE-2026-105299 | high | 8.7 | No | Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through upstream_request_filter and w... | 2026-10-20 |
| CVE-2026-105298 | not reported | — | No | Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority pseudo-header. Request filter... | 2026-10-20 |
| CVE-2026-105815 | not reported | — | No | TP-Link Tapo C210 V3.60 may expose shared credential material and cryptographic metadata through unauthenticated DS JSON API requests. The e... | 2026-10-20 |
| CVE-2026-105814 | not reported | — | No | TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON API. A crafted JSON request containing both a protect... | 2026-10-20 |
| CVE-2026-105810 | not reported | — | No | Tapo C320WS V2.0 contains an authenticated stack-based buffer overflow in the local onboarding Wi-Fi configuration path. An authenticated at... | 2026-10-20 |
| CVE-2026-100737 | medium | 4.9 | No | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to... | 2026-10-20 |
| CVE-2026-105297 | high | 7.5 | No | Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded... | 2026-10-20 |
| CVE-2026-97162 | critical | 9.8 | No | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-113703 | critical | 9.3 | No | SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication... | 2026-10-20 |
| CVE-2026-113612 | medium | 5.4 | No | SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food varia... | 2026-10-20 |
| CVE-2026-113610 | medium | 5.4 | No | Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged au... | 2026-10-20 |