Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78359 | medium | 5.4 | No | OTRS does not sufficiently enforce the uniqueness of customer user identities across multiple configured CustomerUser backends. When multipl... | 2026-10-15 |
| CVE-2026-78358 | medium | 4.3 | No | Several administrative actions do not sufficiently validate whether a request was intentionally initiated by the authenticated user. In part... | 2026-10-15 |
| CVE-2026-78357 | critical | 9.1 | No | Previously issued authentication tokens are not immediately invalidated when an OTRS agent or customer user account is deactivated or its pa... | 2026-10-15 |
| CVE-2026-78356 | medium | 5.3 | No | The OTRS Agent Frontend configuration endpoint can be accessed without authentication. This allows unauthenticated remote users to retrieve... | 2026-10-15 |
| CVE-2026-78355 | high | 8.7 | No | A path traversal vulnerability in the OTRS SendSupportBundle functionality allows an authenticated administrator to reference file paths out... | 2026-10-15 |
| CVE-2026-48212 | medium | 4.8 | No | An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequ... | 2026-10-15 |
| CVE-2026-48211 | medium | 5.4 | No | An authenticated administrator can be induced to delete administrative Import/Export templates through a Cross-Site Request Forgery (CSRF) a... | 2026-10-15 |
| CVE-2026-96540 | high | 8.8 | No | An improper access control vulnerability has been identified in the SonicWall Network Security Manager (NSM) on-prem in export settings, pot... | 2026-10-15 |
| CVE-2026-100232 | high | 7.2 | No | Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability has been identi... | 2026-10-15 |
| CVE-2026-0312 | not reported | — | No | Path traversal vulnerabilities in Palo Alto Networks Checkov by Prisma® Cloud enable an unauthenticated local user to write files to arbitra... | 2026-10-15 |
| CVE-2026-0311 | not reported | — | No | A server-side request forgery vulnerability in Palo Alto Networks Checkov by Prisma® Cloud enables a local unauthenticated user to make unau... | 2026-10-15 |
| CVE-2026-110459 | high | 8.6 | No | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain... | 2026-10-15 |
| CVE-2026-110458 | low | 3.7 | No | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec... | 2026-10-15 |
| CVE-2026-110457 | low | 3.7 | No | A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protec... | 2026-10-15 |
| CVE-2026-110456 | medium | 5.3 | No | A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in Un... | 2026-10-15 |
| CVE-2026-110455 | high | 8.1 | No | A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in... | 2026-10-15 |
| CVE-2026-110454 | medium | 5.3 | No | A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access... | 2026-10-15 |
| CVE-2026-88964 | not reported | — | No | An integer underflow in OpenVPN version 2.7_alpha3 through 2.7.7 on Windows and Android allows remote authenticated servers to cause a denia... | 2026-10-15 |
| CVE-2026-105390 | not reported | — | No | Improper synchronization in the OpenVPN ovpn-dco-win for Windows versions 0.6.5 through 1.3.5 and 2.4.0 through 2.8.7 allows local attackers... | 2026-10-15 |
| CVE-2026-78632 | medium | 5.3 | No | The Okta RADIUS Agent Windows installer assigns write permissions to the NT SERVICE\ALL SERVICES and CREATOR OWNER security principals on th... | 2026-10-15 |