Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103503 | not reported | — | No | Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate f... | 2026-10-16 |
| CVE-2026-103527 | medium | 6.1 | No | Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabl... | 2026-10-16 |
| CVE-2026-103524 | medium | 4.8 | No | Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored withou... | 2026-10-16 |
| CVE-2026-103523 | medium | 6.1 | No | Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully... | 2026-10-16 |
| CVE-2026-103060 | not reported | — | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in erlang rebar3 allows a malicious package pub... | 2026-10-16 |
| CVE-2026-102527 | not reported | — | No | Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.2.5 until 6.7.0, the dynamic /_og/d/*.png route accepts unsigned reques... | 2026-10-16 |
| CVE-2026-85794 | medium | 5.5 | No | Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information locally. | 2026-10-16 |
| CVE-2026-100349 | not reported | — | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.146.0, openapi3filter.ValidateResponse passes a nil response header schem... | 2026-10-16 |
| CVE-2026-101020 | high | 7.8 | No | An incorrect permission assignment for critical resource issue exists in AssetView, AssetView CLOUD, and AssetView Cloud +. If this vulnerab... | 2026-10-16 |
| CVE-2026-54710 | high | 8.8 | No | FreePBX is an open source IP PBX. Prior to versions 16.0.40 and 17.0.7, a critical remote code execution (RCE) vulnerability exists in the s... | 2026-10-16 |
| CVE-2026-85334 | high | 7.5 | No | Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network. | 2026-10-16 |
| CVE-2026-85333 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authori... | 2026-10-16 |
| CVE-2026-111105 | high | 7.0 | No | Telegram rlottie Numeric Truncation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary cod... | 2026-10-16 |
| CVE-2026-110872 | medium | 5.9 | No | Nodemailer from 3.0.0 before 10.0.10 contains a quadratic complexity denial of service vulnerability in the SMTP client reply parser in SMTP... | 2026-10-16 |
| CVE-2026-110869 | high | 7.5 | No | Nodemailer 3.0.0 before 10.0.13 has a regular expression denial of service in SMTPConnection._actionEHLO, whose four AUTH mechanism detectio... | 2026-10-16 |
| CVE-2026-110867 | high | 8.5 | No | Renovate before 44.60.1 contains an allowlist bypass vulnerability that allows repositories to set restricted environment variables by placi... | 2026-10-16 |
| CVE-2026-110859 | high | 7.5 | No | GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files... | 2026-10-16 |
| CVE-2026-110855 | medium | 6.5 | No | GitPython before 3.2.0 contains an information disclosure vulnerability that allows malicious repositories to expand environment variables v... | 2026-10-16 |
| CVE-2026-110854 | not reported | — | No | Parse Server before 8.6.97 and 9.0.0 before 9.10.2-alpha.6 does not handle errors raised while sending verification or password reset emails... | 2026-10-16 |
| CVE-2026-109595 | medium | 5.5 | No | Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the... | 2026-10-16 |