Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92877 | not reported | — | No | The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP... | 2026-10-16 |
| CVE-2026-92120 | critical | 9.1 | No | OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to up... | 2026-10-16 |
| CVE-2026-92119 | critical | 9.1 | No | REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrad... | 2026-10-16 |
| CVE-2026-92116 | critical | 9.1 | No | OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgr... | 2026-10-16 |
| CVE-2026-89079 | critical | 9.8 | No | The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.... | 2026-10-16 |
| CVE-2026-89202 | medium | 6.5 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization chec... | 2026-10-16 |
| CVE-2026-89197 | high | 8.8 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input... | 2026-10-16 |
| CVE-2026-85976 | medium | 5.4 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query C... | 2026-10-16 |
| CVE-2026-85957 | high | 7.5 | No | Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, w... | 2026-10-16 |
| CVE-2026-85949 | high | 8.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnosti... | 2026-10-16 |
| CVE-2026-85499 | critical | 9.1 | No | Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-pro... | 2026-10-16 |
| CVE-2026-69926 | high | 7.8 | No | Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges... | 2026-10-16 |
| CVE-2026-79715 | medium | 5.5 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An... | 2026-10-16 |
| CVE-2026-78556 | high | 7.4 | No | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly valid... | 2026-10-16 |
| CVE-2026-81856 | not reported | — | No | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile r... | 2026-10-16 |
| CVE-2026-75505 | not reported | — | No | EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission c... | 2026-10-16 |
| CVE-2026-63442 | high | 8.1 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the unauthenticated WebGUI login usernamefld accepts ca... | 2026-10-16 |
| CVE-2026-62679 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.6.4, SecurePathController, which serves GET /image/{path}, concatenates the... | 2026-10-16 |
| CVE-2026-63354 | critical | 9.6 | No | Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before rendering it on the T... | 2026-10-16 |
| CVE-2026-59241 | high | 8.8 | No | A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions < V8.0 Update 11), SIMATIC WinCC... | 2026-10-16 |