Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16466 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary commands due to o... | 2026-10-06 |
| CVE-2026-84106 | high | 8.9 | No | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to execute arbitrary code due to improper neutralization of in... | 2026-10-06 |
| CVE-2026-84108 | high | 8.1 | No | IBM Guardium Data Protection 12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of input during web... | 2026-10-06 |
| CVE-2026-16673 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 IBM DataStage could allow a remote authenticated attacker to execute arbitrary OS commands due t... | 2026-10-06 |
| CVE-2026-84239 | high | 7.6 | No | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper neutralization... | 2026-10-06 |
| CVE-2026-84241 | high | 8.1 | No | IBM Guardium Data Protection 12.2 could allow a remote attacker to bypass security restrictions due to improper authorization. | 2026-10-06 |
| CVE-2026-94408 | medium | 4.9 | No | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead denial of service via Excessive Allocation (CAPEC-130) | 2026-10-06 |
| CVE-2026-59788 | not reported | — | No | The email media type OAuth form passes the Authorization endpoint value to window.open() without validating the URL scheme, so a javascript:... | 2026-10-06 |
| CVE-2026-59787 | not reported | — | No | The Perl SNMP trap receiver script shipped with Zabbix does not properly neutralize the ZBXTRAP record delimiter in trap content. This means... | 2026-10-06 |
| CVE-2026-59786 | not reported | — | No | Zabbix Server and Proxy accept the active agent heartbeat message regardless of the configured PSK or certificate authentication. This means... | 2026-10-06 |
| CVE-2026-59785 | not reported | — | No | Host search in Frontend allows filtering by fields that are not displayed, including stored IPMI and PSK credentials. A user with read acces... | 2026-10-06 |
| CVE-2026-59783 | not reported | — | No | The Zabbix Server/Proxy has a vulnerability where binary items can crash the Server/Proxy on certain NULL byte input leading to potential lo... | 2026-10-06 |
| CVE-2026-59782 | not reported | — | No | The JavaScript preprocessing (Duktape) engine on Zabbix server has a vulnerability where a limited administrator is able to read raw heap da... | 2026-10-06 |
| CVE-2026-81478 | critical | 9.8 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Hard-coded Cryptographic Key vulnerability. An unauthent... | 2026-10-06 |
| CVE-2026-105798 | high | 8.7 | No | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029... | 2026-10-06 |
| CVE-2026-105841 | high | 7.5 | No | lrzsz before 0.13.0 contains an OS command injection vulnerability in the lrz receive utility's pipe mode that allows remote senders to exec... | 2026-10-06 |
| CVE-2026-95263 | high | 7.2 | No | Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control. A low-privilege backend administrator with administrator-update permission can ch... | 2026-10-06 |
| CVE-2026-105217 | low | 3.1 | No | Cockpit CMS 2.12.0 before 2.14.1 disables TLS certificate verification in the cron.php web worker restart request, allowing network attacker... | 2026-10-06 |
| CVE-2026-105086 | high | 8.7 | No | WWBN AVideo 12.4 through 29.2.0 contains a stored cross-site scripting vulnerability that allows authenticated uploaders to inject HTML by s... | 2026-10-06 |
| CVE-2026-105131 | medium | 5.4 | No | ezBookkeeping 1.2.0 before 2.0.1 contains a privilege escalation vulnerability that allows attackers holding an API token to obtain a full s... | 2026-10-06 |