Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-67075 | medium | 6.5 | No | HCL Digital Experience is affected by improper input sanitation. This can result in HTML injection which could be leveraged in content spoof... | 2026-10-01 |
| CVE-2026-34190 | not reported | — | No | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when... | 2026-10-01 |
| CVE-2026-34189 | not reported | — | No | Cross-Site Request Forgery (CSRF) vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticat... | 2026-10-01 |
| CVE-2026-18734 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descri... | 2026-10-01 |
| CVE-2026-12855 | high | 8.2 | No | Unvalidated memory boundary could result in arbitrary code execution. The vulnerability exists in the code developed specifically for HP pro... | 2026-10-01 |
| CVE-2026-103664 | not reported | — | No | MISP contains a reflected cross-site scripting (XSS) vulnerability in the analyst data notes panel. The seed path parameter, supplied by the... | 2026-10-01 |
| CVE-2026-103662 | not reported | — | No | MISP contains a reflected cross-site scripting (XSS) vulnerability in the legacy taxonomy tag management confirmation forms (add tag and dis... | 2026-10-01 |
| CVE-2026-103659 | not reported | — | No | MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the ap... | 2026-10-01 |
| CVE-2026-103655 | not reported | — | No | MISP contains a vulnerability in its two-factor authentication (TOTP) verification process that permits a valid one-time code to be accepted... | 2026-10-01 |
| CVE-2026-103651 | not reported | — | No | MISP contains a vulnerability in its one-time password (OTP) authentication flow that allows replay of a consumed HOTP (paper) token and rew... | 2026-10-01 |
| CVE-2026-103587 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, w... | 2026-10-01 |
| CVE-2026-103493 | high | 8.1 | No | In JetBrains YouTrack before 2026.2.19422 stored XSS via Mermaid and LaTeX content was possible | 2026-10-01 |
| CVE-2026-103431 | high | 7.7 | No | colmux in collectl before 4.3.20.2 does not sanitize ANSI/VT100 terminal escape sequences in data received from remote collectl instances be... | 2026-10-01 |
| CVE-2026-103585 | not reported | — | No | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki MediaSearc... | 2026-10-01 |
| CVE-2026-103584 | not reported | — | No | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in The Wikimedia Foundation MediaWiki CommonsMet... | 2026-10-01 |
| CVE-2026-103476 | medium | 5.3 | No | yii2-starter-kit through 4.2.0 fails to validate article publication status in the attachment-download endpoint, allowing unauthenticated at... | 2026-10-01 |
| CVE-2026-103286 | high | 7.3 | No | Ghost versions from 2.21.0 before 6.56.0 contain a privilege escalation vulnerability in the notifications system that allows low-privilege... | 2026-10-01 |
| CVE-2026-103253 | high | 8.7 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an SQL injection vulnerability in the Oracle D... | 2026-10-01 |
| CVE-2026-103113 | medium | 4.7 | No | A vulnerability was determined in OS4ED openSIS-Classic up to 9.3. The affected element is the function save action of the file modules/stud... | 2026-10-01 |
| CVE-2026-102805 | medium | 6.5 | No | A flaw has been found in Nothings stb up to 1.16. This affects the function stbi_write_png_to_mem/stbi_write_jpg_core/stbi_write_tga_core in... | 2026-10-01 |