Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108583 | medium | 4.2 | No | zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services becau... | 2026-10-16 |
| CVE-2026-108582 | medium | 5.5 | No | GenOffice through 0.11.505 contains an incorrect permissions vulnerability in its HTTP MCP server file store that allows local unprivileged... | 2026-10-16 |
| CVE-2026-108555 | medium | 4.2 | No | PairDrop through 1.11.2 contains an IP spoofing vulnerability in Peer._setIP that allows remote attackers to join other networks' discovery... | 2026-10-16 |
| CVE-2026-108554 | medium | 5.3 | No | PDFMathTranslate (pdf2zh) through 1.9.11 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make... | 2026-10-16 |
| CVE-2026-108550 | high | 8.8 | No | SkillHub before 0.2.22 contains an incorrect authorization vulnerability in AccountMergeService and AccountMergeController that allows authe... | 2026-10-16 |
| CVE-2026-108548 | high | 7.3 | No | AstronRPA through 1.1.6 contains an authentication bypass vulnerability in the OpenResty gateway's auth_handler.lua that accepts any Bearer... | 2026-10-16 |
| CVE-2026-108115 | medium | 4.9 | No | Kortix Suna 0.10.7 before 0.13.52 contains a server-side request forgery vulnerability that allows project managers to bypass the isPrivateI... | 2026-10-16 |
| CVE-2026-108164 | medium | 6.5 | No | Open Source Social Network (OSSN) through 10.1 contains an insecure direct object reference vulnerability in components/OssnMessages/ossn_co... | 2026-10-16 |
| CVE-2026-108163 | medium | 6.5 | No | Pingvin Share X before 1.22.0 contains an ineffective rate limiting vulnerability because throttler TTL values specified in seconds are inte... | 2026-10-16 |
| CVE-2026-108162 | medium | 6.5 | No | Pingvin Share X before 1.22.0 contains a rate limit bypass vulnerability that allows unauthenticated remote attackers to evade per-IP thrott... | 2026-10-16 |
| CVE-2026-108161 | high | 7.5 | No | FusionPBX through 5.6.5 contains an OS command injection vulnerability in call_recordings::download() that allows unauthenticated attackers... | 2026-10-16 |
| CVE-2026-70023 | high | 7.8 | No | Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-93649 | high | 7.5 | No | In the Eclipse Adoptium website (adoptium.net), in every deployment built from commit 0b24ea1 (2025-06-18) up to the fix in commit cbb53cf (... | 2026-10-16 |
| CVE-2026-89279 | medium | 6.5 | No | Cross-Site request forgery (CSRF) vulnerability in AuthTake Technology Inc. Authtake allows Encryption Brute Forcing. This issue affects au... | 2026-10-16 |
| CVE-2026-85457 | high | 8.1 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary code due to a stack-based buffer overfl... | 2026-10-16 |
| CVE-2026-85215 | high | 7.1 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in GG Soft Software Services Inc. Paperwo... | 2026-10-16 |
| CVE-2026-79607 | medium | 5.5 | No | During Xenstore live update the state record for a Xenstore watch with specified watch depth is written with two bytes missing. This results... | 2026-10-16 |
| CVE-2026-82632 | low | 3.1 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.9 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th... | 2026-10-16 |
| CVE-2026-78335 | medium | 4.2 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 th... | 2026-10-16 |
| CVE-2026-108129 | medium | 6.5 | No | Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network. | 2026-10-16 |