Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15575 | medium | 5.3 | No | Active debug code vulnerability in SFM Software Technologies Inc. Costifier allows Exploit Non-Production Interfaces. This issue affects Co... | 2026-10-16 |
| CVE-2026-15219 | medium | 6.5 | No | Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc. Costifier allows Exploitation of Trusted Id... | 2026-10-16 |
| CVE-2026-14177 | high | 7.5 | No | Observable response discrepancy vulnerability in IKAS Technology Inc. Ikas E-Commerce Infrastructure allows Account Footprinting. This issu... | 2026-10-16 |
| CVE-2026-63618 | high | 7.5 | No | Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affe... | 2026-10-16 |
| CVE-2026-96806 | medium | 5.8 | No | The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but `KeycloakJWTMi... | 2026-10-16 |
| CVE-2026-94135 | medium | 4.3 | No | The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH host-key verificatio... | 2026-10-16 |
| CVE-2026-94134 | critical | 9.1 | No | The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` i... | 2026-10-16 |
| CVE-2026-92228 | medium | 6.5 | No | The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role global read access to au... | 2026-10-16 |
| CVE-2026-110310 | medium | 5.3 | No | A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an ob... | 2026-10-16 |
| CVE-2026-110248 | medium | 5.3 | No | Insertion of sensitive information into log files in the git_utils[.]py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 bef... | 2026-10-16 |
| CVE-2026-0893 | not reported | — | No | AMI APTIOV contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by loca... | 2026-10-16 |
| CVE-2025-58774 | not reported | — | No | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Buffer Access with Incorrect Length Value” by local access. Successful ex... | 2026-10-16 |
| CVE-2025-58773 | not reported | — | No | AMI APTIOV contains vulnerabilities in BIOS where users may cause "Out-of-bounds Write” by local access. Successful exploitation of this vul... | 2026-10-16 |
| CVE-2025-58772 | not reported | — | No | AMI APTIOV contains vulnerabilities in BIOS where users may cause “Classic Buffer Overflow” by local access. Successful exploitation of thi... | 2026-10-16 |
| CVE-2026-103658 | medium | 5.9 | No | GNU Aspell 0.60.8.2 (first vulnerable version is not known) contains a heap-based buffer overflow write (CWE-122) in its read-only dictionar... | 2026-10-16 |
| CVE-2026-111413 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross Site Request Forgery... | 2026-10-16 |
| CVE-2026-111409 | medium | 5.3 | No | Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce yith-paypal-express-checkout-for-woocommerce allows... | 2026-10-16 |
| CVE-2026-111405 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights Production MapSVG ma... | 2026-10-16 |
| CVE-2026-111400 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Addons for... | 2026-10-16 |
| CVE-2026-111399 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights Production MapSVG ma... | 2026-10-16 |