Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-50055 | medium | 6.5 | No | A policy-enforcement flaw in Zimbra Collaboration Suite allows an authenticated user to bypass disabled mail forwarding by using a Sieve not... | 2026-10-08 |
| CVE-2026-50054 | high | 7.1 | No | An authorization flaw in Zimbra Collaboration Suite’s GrantRightsRequest allows an attacker with access to an authenticated account to grant... | 2026-10-08 |
| CVE-2026-10631 | medium | 6.5 | No | An authorization bypass in the EWS FindItem handler of Zimbra Collaboration Suite 10.1.0 through 10.1.19 allows an authenticated user with E... | 2026-10-08 |
| CVE-2026-107604 | medium | 4.9 | No | A flaw was found in the installation provider and client registration endpoints of the Keycloak identity management service. A realm adminis... | 2026-10-08 |
| CVE-2026-107275 | medium | 6.8 | No | @fastify/jwt is a JSON Web Token plugin for the Fastify web framework. In versions before 10.2.3, a time span passed to expiresIn, notBefore... | 2026-10-08 |
| CVE-2026-102488 | not reported | — | No | In affected versions, Octopus Server incorrectly evaluates multiple scoped permission assignments, allowing a highly privileged user to obta... | 2026-10-08 |
| CVE-2026-107315 | medium | 5.3 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in... | 2026-10-08 |
| CVE-2026-107314 | medium | 5.9 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property exclude... | 2026-10-08 |
| CVE-2026-107313 | medium | 4.2 | No | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first p... | 2026-10-08 |
| CVE-2026-106164 | high | 7.3 | No | In Progress® Telerik® Document Processing SpreadProcessing library, versions prior to 2026.3.1006, an infinite loop vulnerability exists whe... | 2026-10-08 |
| CVE-2026-107300 | high | 7.5 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder recursively invokes itself for ea... | 2026-10-08 |
| CVE-2026-107297 | medium | 5.9 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, the streaming decoder reparses an incomplete array or m... | 2026-10-08 |
| CVE-2026-105570 | not reported | — | No | Docker Sandboxes compared OAuth token-endpoint hostnames case-sensitively when deciding whether to mask managed credential responses, while... | 2026-10-08 |
| CVE-2026-105452 | not reported | — | No | Docker Sandboxes could forward a client-supplied credential alongside a credential injected by the host egress proxy. The proxy removed alte... | 2026-10-08 |
| CVE-2026-101998 | not reported | — | No | Docker Sandboxes could fail open while masking credentials in protected proxy responses. When a response-body read returned data together wi... | 2026-10-08 |
| CVE-2026-92543 | not reported | — | No | Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries() injects 127.0.0.0/8 and ::1/... | 2026-10-08 |
| CVE-2026-92542 | not reported | — | No | The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and... | 2026-10-08 |
| CVE-2026-26950 | high | 8.8 | No | Dell SmartFabric Manager, versions prior to 2.2.1, contains an Insufficient Verification of Data Authenticity vulnerability. A low privilege... | 2026-10-08 |
| CVE-2026-54471 | medium | 6.5 | No | Dell SmartFabric Manager, versions prior to 2.2.1, contains an Improper Handling of Insufficient Permissions or Privileges vulnerability. A... | 2026-10-08 |
| CVE-2026-67100 | critical | 9.8 | No | HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an... | 2026-10-08 |