Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106150 | medium | 5.4 | No | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip... | 2026-10-15 |
| CVE-2026-106139 | medium | 5.4 | No | In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip render... | 2026-10-15 |
| CVE-2026-106138 | medium | 5.4 | No | In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders th... | 2026-10-15 |
| CVE-2026-105274 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex_core allows an untrusted repository mirror, or a... | 2026-10-15 |
| CVE-2026-105409 | high | 8.7 | No | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec... | 2026-10-15 |
| CVE-2026-105408 | high | 8.7 | No | A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to exec... | 2026-10-15 |
| CVE-2026-105407 | high | 8.8 | No | An OS Command Injection vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrar... | 2026-10-15 |
| CVE-2026-103929 | high | 7.8 | No | mise manages dev tools like node, python, cmake, and terraform. Prior to 2026.7.14, in the default non-safe mode, mise loads .mise.toml [set... | 2026-10-15 |
| CVE-2026-104115 | not reported | — | No | A stack-based buffer overflow in the illumos reparse point daemon (reparsed) allows a local user to crash the daemon. get_fs_locations() in... | 2026-10-15 |
| CVE-2026-101947 | not reported | — | No | ExifTool for photo and video 5.0.1-gms by CellHubs constructs shell command strings from file paths and invokes /system/bin/sh -c. In the CS... | 2026-10-15 |
| CVE-2026-103413 | high | 8.8 | No | Improper input validation vulnerability in Apache Camel Karavan. When a deployment was started, Karavan unmarshalled a project's `kubernete... | 2026-10-15 |
| CVE-2026-103412 | high | 8.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Apache Camel Karavan. A project file name s... | 2026-10-15 |
| CVE-2026-100354 | high | 7.5 | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.149.0, runtime request, response, and direct schema validation lacks cycl... | 2026-10-15 |
| CVE-2026-100350 | medium | 5.3 | No | kin-openapi is a Go project for handling OpenAPI files. From 0.145.0 until 0.146.0, openapi3filter repeatedly calls regexp.MustCompile for t... | 2026-10-15 |
| CVE-2026-0314 | not reported | — | No | A type confusion vulnerability in Palo Alto Networks GlobalProtect™ app on Windows enables a local user with low privileges to cause a denia... | 2026-10-15 |
| CVE-2017-20283 | medium | 6.5 | No | NXP MQX Classic before 5.0 contains an out-of-bounds write vulnerability in the RTCS UDP recvfrom() implementation. Improper enforcement of... | 2026-10-15 |
| CVE-2026-19627 | high | 8.2 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to read arbitrary host files and overwrite certain application files due t... | 2026-10-15 |
| CVE-2026-75061 | high | 7.5 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to traverse directories on the system. An attacker could send a specially... | 2026-10-15 |
| CVE-2026-75063 | medium | 5.4 | No | IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to improper output encod... | 2026-10-15 |
| CVE-2026-59318 | critical | 9.8 | No | In Spring AI's tool calling support, the per-request tool list is advertised to the model as a boundary but is not fully enforced when a too... | 2026-10-15 |