Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107807 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential throug... | 2026-10-20 |
| CVE-2026-107808 | high | 8.1 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a... | 2026-10-20 |
| CVE-2026-85511 | medium | 4.2 | No | A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection wo... | 2026-10-20 |
| CVE-2026-112779 | critical | 9.8 | No | Grav API plugin (grav-plugin-api) 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the... | 2026-10-20 |
| CVE-2026-112774 | high | 7.2 | No | Craft CMS from 5.8.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated administrators to inject Yii beh... | 2026-10-20 |
| CVE-2026-111862 | critical | 9.8 | No | Rank Math SEO PRO for WordPress is affected by a supply-chain compromise in a subset of version 3.0.123 packages downloaded or updated betwe... | 2026-10-20 |
| CVE-2026-109126 | high | 8.8 | No | IBM Verify Identity Access 11.0.3.1 and IBM Security Verify Access 10.0.9.3 Appliance could allow a physically proximate attacker to gain el... | 2026-10-20 |
| CVE-2026-107809 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an... | 2026-10-20 |
| CVE-2026-107810 | high | 8.1 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before... | 2026-10-20 |
| CVE-2026-107811 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, ordinary authenticated users can access /api/nodes and /a... | 2026-10-20 |
| CVE-2026-107400 | high | 8.8 | No | IBM TRIRIGA Application Platform 5.0.0 through 5.0.8 could allow a remote authenticated attacker to execute arbitrary code due to improper a... | 2026-10-20 |
| CVE-2026-19178 | medium | 6.8 | No | IBM Storage TS4500 Library 1.1.1.6 through 1.12.0.3 could allow a remote authenticated attacker to gain unauthorized administrative privileg... | 2026-10-20 |
| CVE-2026-107812 | high | 7.5 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the self-upgrade mechanism validates a downloaded binary... | 2026-10-20 |
| CVE-2026-107813 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, the api/cluster router exposes node and namespace mutatio... | 2026-10-20 |
| CVE-2026-63690 | high | 7.4 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability in the csi... | 2026-10-20 |
| CVE-2026-97246 | medium | 4.9 | No | Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.... | 2026-10-20 |
| CVE-2026-81452 | high | 7.0 | No | Dell Alienware Command Center (AWCC), versions prior to 6.14.54.0, contain a Least Privilege Violation vulnerability. A low privileged attac... | 2026-10-20 |
| CVE-2026-80092 | medium | 5.3 | No | Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network... | 2026-10-20 |
| CVE-2026-80726 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-20 |
| CVE-2026-79985 | high | 7.4 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel SMB component. This issue affe... | 2026-10-20 |