Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-34499 | not reported | — | No | Use of hard-coded cryptographic key vulnerability in Johnson Controls ADVMS allows Read Sensitive Constants Within an Executable. This issu... | 2026-10-08 |
| CVE-2026-106557 | high | 7.7 | No | Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did n... | 2026-10-08 |
| CVE-2026-33586 | not reported | — | No | Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail ser... | 2026-10-08 |
| CVE-2026-93034 | critical | 9.8 | No | SGLang contains an arbitrary code execution vulnerability caused by the ZMQ message decoder unconditionally deserializing PickleWrapper payl... | 2026-10-08 |
| CVE-2026-66087 | high | 8.1 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to operate task instance in projects they are no... | 2026-10-08 |
| CVE-2026-66084 | high | 8.1 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to modify task definitions in projects they are... | 2026-10-08 |
| CVE-2026-66082 | medium | 6.5 | No | An authorization bypass vulnerability in Apache DolphinScheduler allows authenticated users to perform unauthorized operations on workflow s... | 2026-10-08 |
| CVE-2026-107706 | medium | 4.3 | No | Dolibarr ERP CRM before 24.0.2 contains an incorrect authorization vulnerability in htdocs/core/ajax/updateextrafield.php that checks only r... | 2026-10-08 |
| CVE-2026-107709 | high | 7.8 | No | A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability located in `lib/decompress-zip.js` im... | 2026-10-08 |
| CVE-2026-106126 | critical | 9.9 | No | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-p... | 2026-10-08 |
| CVE-2022-36227 | critical | 9.8 | No | In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if th... | 2026-10-08 |
| CVE-2021-44906 | critical | 9.8 | No | Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). | 2026-10-08 |
| CVE-2021-3711 | critical | 9.8 | No | In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will... | 2026-10-08 |
| CVE-2021-3331 | critical | 9.8 | No | WinSCP before 5.17.10 allows remote attackers to execute arbitrary programs when the URL handler encounters a crafted URL that loads session... | 2026-10-08 |
| CVE-2020-8840 | critical | 9.8 | No | FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyedi... | 2026-10-08 |
| CVE-2020-27619 | critical | 9.8 | No | In Python 3 through 3.9.0, the Lib/test/multibytecodec_support.py CJK codec tests call eval() on content retrieved via HTTP. | 2026-10-08 |
| CVE-2019-17531 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globall... | 2026-10-08 |
| CVE-2019-16942 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globall... | 2026-10-08 |
| CVE-2019-16335 | critical | 9.8 | No | A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource.... | 2026-10-08 |
| CVE-2019-14892 | critical | 9.8 | No | A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization... | 2026-10-08 |