Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100503 | medium | 5.5 | No | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by st... | 2026-10-08 |
| CVE-2026-100504 | high | 7.0 | No | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when proces... | 2026-10-08 |
| CVE-2026-100505 | medium | 4.4 | No | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte U... | 2026-10-08 |
| CVE-2026-93988 | medium | 6.5 | No | QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-of... | 2026-10-08 |
| CVE-2026-93452 | high | 7.5 | No | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of... | 2026-10-08 |
| CVE-2026-93451 | medium | 6.5 | No | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays b... | 2026-10-08 |
| CVE-2026-92298 | medium | 4.8 | No | EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of... | 2026-10-08 |
| CVE-2026-91991 | medium | 5.4 | No | Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes b... | 2026-10-08 |
| CVE-2026-90936 | medium | 4.3 | No | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can... | 2026-10-08 |
| CVE-2026-90935 | medium | 4.3 | No | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API c... | 2026-10-08 |
| CVE-2026-90559 | high | 7.5 | No | snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination... | 2026-10-08 |
| CVE-2026-88879 | high | 8.2 | No | Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are can... | 2026-10-08 |
| CVE-2026-88878 | medium | 5.3 | No | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoi... | 2026-10-08 |
| CVE-2026-88877 | critical | 9.8 | No | Traefik is a HTTP reverse proxy and load balancer. In versions >= v3.7.0 and <= v3.7.11, the Kubernetes ingress-nginx provider mishandles In... | 2026-10-08 |
| CVE-2026-87807 | high | 7.5 | No | siyuan versions before v3.8.2 contain an authenticated SQL injection vulnerability in the fullTextSearchBlock endpoint's method=1 query para... | 2026-10-08 |
| CVE-2026-86435 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Footnote extension that fails to deduplicate fo... | 2026-10-08 |
| CVE-2026-86434 | high | 7.5 | No | league/commonmark versions >= 2.0.0 and < 2.8.4 (patched in 2.9.0) contain a denial of service vulnerability in UniqueSlugNormalizer::normal... | 2026-10-08 |
| CVE-2026-86433 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.8.4 contain a denial of service vulnerability in the Attributes extension where AttributesListener::... | 2026-10-08 |
| CVE-2026-86432 | medium | 5.3 | No | commonmark versions from 2.0.0 before 2.8.4 contain a denial of service vulnerability in XmlRenderer that emits depth-proportional indentati... | 2026-10-08 |
| CVE-2026-86431 | high | 7.2 | No | league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExte... | 2026-10-08 |