Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90456 | high | 8.1 | No | An example environment-configuration file for a bundled inventory-management component ships with a fixed, publicly-known administrative pas... | 2026-10-02 |
| CVE-2026-90455 | low | 3.7 | No | A prior update that raised a bundled HTTP client library to a version remediating known vulnerabilities was later reverted, reintroducing th... | 2026-10-02 |
| CVE-2026-90454 | medium | 4.3 | No | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable rout... | 2026-10-02 |
| CVE-2026-90453 | low | 3.5 | No | A file-upload handler redirects the authenticated client's browser to a URL taken directly from that same request's Referer header, without... | 2026-10-02 |
| CVE-2026-90452 | medium | 5.3 | No | Requests from the reverse proxy to the identity-provider service for token discovery, introspection, and credential exchange do not verify t... | 2026-10-02 |
| CVE-2026-51916 | high | 7.5 | No | TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/know... | 2026-10-02 |
| CVE-2026-51899 | medium | 4.3 | No | In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule... | 2026-10-02 |
| CVE-2026-104444 | high | 7.1 | No | YesWiki before 4.6.7 contains an authorization bypass vulnerability in the comments API editComment route that allows authenticated low-priv... | 2026-10-02 |
| CVE-2026-100661 | high | 7.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain a denial-of-service vulnerability in the... | 2026-10-02 |
| CVE-2026-47360 | high | 7.5 | No | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HTTP Server's mod_session_cookie module. When SessionCoo... | 2026-10-02 |
| CVE-2026-56153 | high | 7.5 | No | Out-of-bounds Write vulnerability in Apache HTTP Server's mod_charset_lite. This issue affects Apache HTTP Server: from 2.4.0 through 2.4.6... | 2026-10-02 |
| CVE-2026-100255 | critical | 9.8 | No | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset | 2026-10-02 |
| CVE-2026-100256 | high | 7.8 | No | In JetBrains IntelliJ IDEA before 2026.2.3 rCE via Structural Search script constraints was possible in untrusted projects | 2026-10-02 |
| CVE-2026-100257 | medium | 4.3 | No | In JetBrains YouTrack before 2026.2.18991 sSRF via stored XHTML injection was possible during PDF export | 2026-10-02 |
| CVE-2026-100258 | medium | 4.3 | No | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed read-only users to read project settings | 2026-10-02 |
| CVE-2026-100259 | medium | 4.3 | No | In JetBrains YouTrack before 2026.2.18991 improper access control on Gantt chart allowed edits by users with view-only access | 2026-10-02 |
| CVE-2026-100260 | medium | 5.3 | No | In JetBrains YouTrack before 2026.2.18991 mailbox integration allowed authentication after a password reset | 2026-10-02 |
| CVE-2026-100261 | medium | 5.4 | No | In JetBrains YouTrack before 2026.2.18991 changing article visibility settings was possible without update permission | 2026-10-02 |
| CVE-2026-100262 | high | 7.1 | No | In JetBrains YouTrack before 2026.2.18991 missing authorisation allowed users with read-only project access to overwrite project notificatio... | 2026-10-02 |
| CVE-2026-100263 | medium | 6.1 | No | In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible | 2026-10-02 |