Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86430 | high | 7.5 | No | league/commonmark versions before 2.9.1 contain multiple denial of service vulnerabilities in fenced code block detection, reference link la... | 2026-10-08 |
| CVE-2026-86429 | high | 7.5 | No | The league/commonmark (thephpleague/commonmark) library in versions >= 1.5.0 and < 2.9.1 contains quadratic parsing complexity in its SmartP... | 2026-10-08 |
| CVE-2026-86204 | medium | 6.5 | No | PocketMine-MP versions before 5.39.2 fail to limit JSON payload size in ModalFormResponsePacket handling, allowing authenticated players to... | 2026-10-08 |
| CVE-2026-86203 | low | 3.7 | No | PocketMine-MP versions before 5.39.2 fail to validate entity despawn state when processing attack packets from clients. Attackers can exploi... | 2026-10-08 |
| CVE-2026-86202 | medium | 4.3 | No | PocketMine-MP versions before 5.39.2 contain a network amplification vulnerability in ActorEventPacket handling that allows clients to trigg... | 2026-10-08 |
| CVE-2026-86201 | high | 7.5 | No | PocketMine-MP before 5.41.1 contains a denial of service vulnerability in LoginPacket processing where large or complex structures in unknow... | 2026-10-08 |
| CVE-2026-86200 | medium | 5.3 | No | PocketMine-MP versions before 5.42.1 contain a denial of service vulnerability in the LoginPacket handler that allows remote attackers to fl... | 2026-10-08 |
| CVE-2026-86428 | high | 7.5 | No | commonmark versions from 1.5.0 before 2.10.0 contain a denial of service vulnerability in the AttributesExtension when processing distinctly... | 2026-10-08 |
| CVE-2026-86197 | not reported | — | No | Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav... | 2026-10-08 |
| CVE-2026-85597 | critical | 9.1 | No | Traefik before v2.11.55 and v3.0.0 through v3.7.10 contain a TLS option conflict resolution vulnerability that allows unauthenticated attack... | 2026-10-08 |
| CVE-2026-85596 | critical | 9.8 | No | Traefik versions >= v3.7.0 and <= v3.7.10 contain an authentication bypass in the Kubernetes Ingress NGINX provider. The TLS option generate... | 2026-10-08 |
| CVE-2026-85595 | critical | 9.8 | No | Traefik versions before v2.11.55 and versions v3.0.0 through v3.7.10 contain an authentication bypass vulnerability in the digestAuth middle... | 2026-10-08 |
| CVE-2026-85594 | critical | 9.8 | No | Traefik versions from v3.7.1 fail to enforce crossProviderNamespaces restrictions on the traefik.ingress.kubernetes.io/service.middlewares S... | 2026-10-08 |
| CVE-2026-85578 | medium | 6.5 | No | SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files... | 2026-10-08 |
| CVE-2026-85210 | medium | 4.3 | No | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate... | 2026-10-08 |
| CVE-2026-84199 | high | 7.7 | No | Kyverno before 1.16.2 contains a server-side request forgery (SSRF) vulnerability in the APICall feature. The URL field in a Policy's Servic... | 2026-10-08 |
| CVE-2026-84192 | high | 7.1 | No | LibreNMS before 26.3.1 contains a stored cross-site scripting vulnerability in legacy PHP templates that output SNMP-sourced and syslog-sour... | 2026-10-08 |
| CVE-2026-84190 | high | 7.2 | No | LibreNMS versions before 26.5.0 contain a remote code execution vulnerability in the AboutController where the snmpget configuration paramet... | 2026-10-08 |
| CVE-2026-84189 | high | 8.1 | No | LibreNMS through 26.4.0 renders JSON fields (name, ip, model, author, commit message) returned by the admin-configurable Oxidized integratio... | 2026-10-08 |
| CVE-2026-84188 | medium | 4.8 | No | LibreNMS versions <= 26.4.0 contain a stored cross-site scripting vulnerability in the graph_descr. configuration settings, which are echoed... | 2026-10-08 |