Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101339 | not reported | — | No | A HIP resource record that fills the RDATA near or at is limit, and has another dname RDATA field (a HIP Rendezvous server) can overwrite th... | 2026-10-16 |
| CVE-2026-101338 | not reported | — | No | When a SVCB or HTTPS RR has filled the wire format RDATA up to the brim, another ECH parameter may overwrite the stack, and once beyond the... | 2026-10-16 |
| CVE-2026-101337 | not reported | — | No | When base64 data is split up in pieces, of 3 character or less, tokens were incorrectly calculated to produce 0 bytes. This enables attacker... | 2026-10-16 |
| CVE-2026-50217 | medium | 4.7 | No | A use-after-free vulnerability in the Windows WFP callout driver of Akamai Guardicore Platform Agent (GPA) allows a local low-privileged use... | 2026-10-16 |
| CVE-2026-50216 | medium | 5.3 | No | An integer underflow exists in the DNS proxy component of the macOS NetworkExtension system extension shipped with Akamai Guardicore Platfor... | 2026-10-16 |
| CVE-2026-46449 | medium | 6.7 | No | The Akamai Guardicore Platform Agent (GPA) before 7.4 for macOS is affected by a local privilege escalation vulnerability within the wapptun... | 2026-10-16 |
| CVE-2026-110385 | not reported | — | No | A remote code execution vulnerability in ONLYOFFICE Document Server versions before10.0.0 allows an authenticated attacker with a valid Inbo... | 2026-10-16 |
| CVE-2026-94453 | high | 7.5 | No | Libreswan's pluto daemon has a use-after-free vulnerability when a client connecting using IKE over TCP closes the connection and another pa... | 2026-10-16 |
| CVE-2026-77207 | high | 7.5 | No | Libreswan has a null pointer dereference bug in the PKCS#7 handling code for IKE certificate authentication. When libreswan decodes an IKE C... | 2026-10-16 |
| CVE-2026-77206 | high | 7.5 | No | Libreswan's IKEv2 state machine has a null pointer dereference bug in the EAP handling code for authentication. As a result of inconsistency... | 2026-10-16 |
| CVE-2026-77205 | low | 3.7 | No | Libreswan in FIPS mode has a vulnerability where badly formed received certificates are rejected, but not deleted from the NSS cache. As a r... | 2026-10-16 |
| CVE-2026-19810 | medium | 5.4 | No | Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, wh... | 2026-10-16 |
| CVE-2026-109758 | not reported | — | No | Perforce Helix Authentication Service (HAS) deployments that retain the shipped default SCIM bearer token are vulnerable to unauthorized acc... | 2026-10-16 |
| CVE-2026-109786 | medium | 5.3 | No | In fail2ban 0.10.5 through 1.1.1 before ddd879d, the sshd filter (config/filter.d/sshd.conf) accepts an "on " suffix after the host address.... | 2026-10-16 |
| CVE-2026-87689 | critical | 9.8 | No | The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through Msf::WebServices::CredentialServlet. Every mutat... | 2026-10-16 |
| CVE-2026-109575 | critical | 9.8 | No | In HAProxy Data Plane API 2.2.0 through 3.4.3 (and corresponding Enterprise Edition releases), Server.ConfigureAPI() has process-global auth... | 2026-10-16 |
| CVE-2026-89140 | not reported | — | No | Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with w... | 2026-10-16 |
| CVE-2026-104355 | not reported | — | No | A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the recei... | 2026-10-16 |
| CVE-2026-92682 | not reported | — | No | In @neo4j/graphql versions from 7.0.0 up to but not including 7.6.4, the none quantifier in @authorization filters on relationships and conn... | 2026-10-16 |
| CVE-2026-92681 | not reported | — | No | In @neo4j/graphql versions up to and including 7.6.3, @authentication directives applied at the schema level or on the Query or Mutation typ... | 2026-10-16 |