Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-61932 | critical | 9.8 | Listed | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests,... | 2026-10-08 |
| CVE-2026-107703 | critical | 9.8 | No | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell comma... | 2026-10-08 |
| CVE-2026-61801 | medium | 5.5 | No | The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files.... | 2026-10-08 |
| CVE-2026-9209 | critical | 9.8 | No | mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the r... | 2026-10-08 |
| CVE-2026-107640 | critical | 9.1 | No | Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthent... | 2026-10-08 |
| CVE-2026-89191 | medium | 6.8 | No | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main d... | 2026-10-08 |
| CVE-2026-105110 | critical | 9.8 | No | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute... | 2026-10-08 |
| CVE-2026-107450 | medium | 5.4 | No | In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only... | 2026-10-08 |
| CVE-2026-107449 | low | 3.4 | No | linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application tes... | 2026-10-08 |
| CVE-2026-56851 | high | 7.5 | No | The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. | 2026-10-08 |
| CVE-2026-105828 | not reported | — | No | Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validati... | 2026-10-08 |
| CVE-2026-107376 | high | 8.2 | No | webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive desce... | 2026-10-08 |
| CVE-2026-93699 | not reported | — | No | Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. | 2026-10-08 |
| CVE-2026-107353 | medium | 6.5 | No | traverse (npm) versions 0.3.6 through 0.3.9, 0.4.0 through 0.4.6, 0.5.0 through 0.5.2, and 0.6.0 through 0.6.11 allow prototype pollution th... | 2026-10-08 |
| CVE-2026-107608 | medium | 5.5 | No | Improper link resolution before file access in the asset bundling output handling in AWS aws-cdk-lib before 2.267.0 might allow a context-de... | 2026-10-08 |
| CVE-2026-107378 | not reported | — | No | CairoSVG is an SVG converter based on Cairo, a 2D graphics library. Prior to 2.9.1, rendering an attacker-controlled SVG with a path contain... | 2026-10-08 |
| CVE-2026-105830 | high | 7.5 | No | league/commonmark from 2.0.0 before 2.10.2 contains a quadratic-time denial of service vulnerability in the GitHub Flavored Markdown Table e... | 2026-10-08 |
| CVE-2026-107446 | medium | 6.8 | No | containerd overlaybd through 1.0.18 has a do_load_index (LSMT index loading) integer overflow (and resultant out-of-bounds heap access) for... | 2026-10-08 |
| CVE-2026-87726 | low | 3.9 | No | Insufficient API bounds checking in phalFelica in NXP NXPNfcRdLib RC663 through 07.14.00_Pub may allow an attacker with privileges or an unt... | 2026-10-08 |
| CVE-2026-107363 | not reported | — | No | In OpenStack Zaqar before 23.0.1, the WebSocket transport fails to bind the project identifier in subsequent requests to the project authent... | 2026-10-08 |