Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104356 | medium | 5.9 | No | PictShare before version 3.7.1 contains a weak randomness vulnerability where the getRandomString() function uses the non-cryptographic rand... | 2026-10-02 |
| CVE-2026-104002 | medium | 5.3 | No | A fail-open error handling issue within the data masking utility of Powertools for AWS Lambda (Python) might allow actors to read sensitive... | 2026-10-02 |
| CVE-2026-104020 | high | 7.5 | No | Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the applicat... | 2026-10-02 |
| CVE-2026-102795 | critical | 9.3 | No | Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 1... | 2026-10-02 |
| CVE-2026-102626 | not reported | — | No | An authenticated LimeSurvey Community Edition 7.4.0 user with the global Surveys: create permission can store a JavaScript-breaking value in... | 2026-10-02 |
| CVE-2026-103098 | high | 7.5 | No | Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning the... | 2026-10-02 |
| CVE-2026-103764 | critical | 9.8 | No | Mooncake transfer engine before 0.3.13 contains an untrusted pointer dereference in ServerSession::readHeader that allows unauthenticated at... | 2026-10-02 |
| CVE-2026-86326 | not reported | — | No | An improper verification of cryptographic signature vulnerability exists in protocol gateways because the device does not properly verify th... | 2026-10-02 |
| CVE-2026-86325 | not reported | — | No | A stack-based buffer overflow vulnerability exists in protocol gateways' account management interface. The vulnerability is caused by insuff... | 2026-10-02 |
| CVE-2026-94418 | high | 7.5 | No | Under WOLFSSL_SMALL_CERT_VERIFY, ProcessPeerCertParse() runs the certificate signature check separately from the parse to keep peak memory d... | 2026-10-02 |
| CVE-2026-15442 | medium | 5.3 | No | In all builds that make use of (D)TLS, including default builds, there is a series of conditional states during the TLS shutdown which could... | 2026-10-02 |
| CVE-2026-89133 | medium | 5.3 | No | wolfSSL versions 5.9.2 and earlier contain a flaw in the X.509 certificate validation logic where it fails to properly enforce NameConstrain... | 2026-10-02 |
| CVE-2026-89134 | critical | 9.1 | No | A certificate with no dNSName SAN but another SAN type present (e.g. registeredID or iPAddress) bypassed the Subject CN dNSName name-constra... | 2026-10-02 |
| CVE-2026-89135 | medium | 6.5 | No | A failed X509_verify_cert call permanently plants an unverified attacker CA in the shared CertManager, bypassing certificate validation in e... | 2026-10-02 |
| CVE-2026-93302 | high | 8.2 | No | MatchTrustedPeer ignores the public key used, leading to forged CA clones passing verification. Affected builds are any that enable the macr... | 2026-10-02 |
| CVE-2026-91784 | not reported | — | No | cjbassi/gotop is vulnerable to local argument injection via process termination functionality. The process name is passed directly to pkill... | 2026-10-02 |
| CVE-2026-103484 | high | 8.8 | No | IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution. | 2026-10-02 |
| CVE-2026-55083 | critical | 9.1 | No | DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. From versions 2.42.0 to before... | 2026-10-02 |
| CVE-2026-93029 | critical | 9.0 | No | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. | 2026-10-02 |
| CVE-2026-103766 | high | 7.2 | No | ClipBucket v5 through 5.5.3-#197 contains an sql injection vulnerability that allows authenticated users with ad_manager_access permission t... | 2026-10-02 |