Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79984 | high | 7.4 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Mina SFTP component. This issu... | 2026-10-20 |
| CVE-2026-78165 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before... | 2026-10-20 |
| CVE-2026-77933 | critical | 9.8 | No | DB-GPT through 0.8.2 contains a hardcoded credentials vulnerability in its default docker-compose.yml that sets a static MYSQL_ROOT_PASSWORD... | 2026-10-20 |
| CVE-2026-77932 | critical | 9.8 | No | DB-GPT through 0.8.2 contains an unauthenticated remote code execution vulnerability because the /api/v1/chat/react-agent endpoint relies on... | 2026-10-20 |
| CVE-2026-112786 | medium | 5.4 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated... | 2026-10-20 |
| CVE-2026-112784 | medium | 4.3 | No | OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to se... | 2026-10-20 |
| CVE-2026-112361 | medium | 6.3 | No | A vulnerability has been found in Dolibarr up to 23.0.2. The impacted element is an unknown function of the file htdocs/document.php of the... | 2026-10-20 |
| CVE-2026-63691 | critical | 9.6 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerM... | 2026-10-20 |
| CVE-2026-67225 | high | 7.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the stream protocol stored the FrameMax... | 2026-10-20 |
| CVE-2026-67226 | medium | 4.9 | No | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7, Admin-only atom exhaustion: PUT /api/users tags... | 2026-10-20 |
| CVE-2026-67227 | medium | 4.9 | No | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.22 and 4.1.14 and 4.2.7 and 4.3.1, Atom exhaustion: toatom on global-para... | 2026-10-20 |
| CVE-2026-67230 | high | 7.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15, 4.0.20, 4.1.11, and 4.2.6, the Web STOMP WebSocket handler enforced... | 2026-10-20 |
| CVE-2026-67234 | medium | 4.3 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, get_auth_mechanism/1 used term_to_binary/1 on the strict_aut... | 2026-10-20 |
| CVE-2026-67270 | high | 7.4 | No | Dell Container Storage Modules (CSM) versions prior to 1.18.0, contains an Improper Certificate Validation vulnerability in the proxy-server... | 2026-10-20 |
| CVE-2026-108743 | high | 8.8 | No | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the... | 2026-10-20 |
| CVE-2026-67273 | critical | 9.6 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) an Improper Neutralization of Special Elements Used in a Template Engin... | 2026-10-20 |
| CVE-2026-67237 | critical | 9.3 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, set_token_auth/2 inserted a bearer token from the Authorizat... | 2026-10-20 |
| CVE-2026-70411 | medium | 6.5 | No | Dell Container Storage Modules (CSM), versions prior to 1.18.0, contains a Missing Authentication for Critical Function vulnerability in the... | 2026-10-20 |
| CVE-2026-73179 | high | 8.1 | No | Improper enforcement of single-use authorization code semantics in the JPA OAuth2 authorization code grant provider in Apache CXFallows a re... | 2026-10-20 |
| CVE-2026-78384 | high | 7.5 | No | CompressionUtils.inflate() decompressed attacker-controlled DEFLATE data with no output-size cap. A small (~KB) crafted payload could expand... | 2026-10-20 |