Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109569 | high | 8.8 | No | sandboxed.sh through 1.3.0 contains a container escape vulnerability that allows code in container workspaces to access the host filesystem... | 2026-10-16 |
| CVE-2026-109567 | high | 7.2 | No | Rapyd Admin from 9.0.0 before 9.20.0 contains an improper privilege management vulnerability in the UsersEdit Livewire component that allows... | 2026-10-16 |
| CVE-2026-109562 | medium | 5.4 | No | SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/u... | 2026-10-16 |
| CVE-2026-109559 | high | 8.7 | No | EdgeEver Desktop 1.6.26 through 1.112.0 contains a navigation allowlist bypass that lets attackers load arbitrary origins in the main window... | 2026-10-16 |
| CVE-2026-109557 | high | 8.7 | No | EdgeEver through 1.112.0 contains a stored cross-site scripting vulnerability in setMemoDragPreview that allows attackers to inject script t... | 2026-10-16 |
| CVE-2026-109379 | medium | 5.3 | No | Cockpit CMS 2.14.1 contains an observable timing discrepancy vulnerability that allows unauthenticated attackers to enumerate accounts due t... | 2026-10-16 |
| CVE-2026-109423 | high | 7.4 | No | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a TLS certificate validation vulnerabilit... | 2026-10-16 |
| CVE-2026-109359 | high | 7.7 | No | Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving... | 2026-10-16 |
| CVE-2026-109394 | high | 7.4 | No | Thirty bees through 1.7.0 contains an authentication bypass vulnerability in PasswordController::resolveCustomer() that allows unauthenticat... | 2026-10-16 |
| CVE-2026-109391 | high | 8.1 | No | Square Squash through commit e73f280 contains an insecure deserialization vulnerability that allows unauthenticated attackers to store craft... | 2026-10-16 |
| CVE-2026-45562 | high | 7.2 | No | FreePBX is an open source IP PBX. Prior to versions 16.0.4 and 17.0.6, the FreePBX Music on Hold (MoH) module contains a critical security f... | 2026-10-16 |
| CVE-2026-54674 | high | 8.8 | No | FreePBX is an open source IP PBX. Prior to versions 16.0.39 and 17.0.7, users authenticated via User Control Panel (UCP) are able to execute... | 2026-10-16 |
| CVE-2026-54675 | high | 8.8 | No | FreePBX is an open source IP PBX. Prior to versions 16.0.10 and 17.0.5, a critical vulnerability exists in the sound language upload and con... | 2026-10-16 |
| CVE-2026-69935 | high | 7.0 | No | Use after free in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-54708 | high | 8.8 | No | FreePBX is an open source IP PBX. Prior to versions 16.0.72 and 17.0.7, a critical vulnerability exists in the FreePBX backup Module that al... | 2026-10-16 |
| CVE-2026-96535 | not reported | — | No | Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL.... | 2026-10-16 |
| CVE-2026-96618 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust th... | 2026-10-16 |
| CVE-2026-96612 | not reported | — | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publish... | 2026-10-16 |
| CVE-2026-69931 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker... | 2026-10-16 |
| CVE-2026-92876 | high | 7.5 | No | IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncon... | 2026-10-16 |