Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102621 | low | 3.3 | No | A vulnerability was identified in Freedesktop Poppler up to 26.08.0. Affected is the function SplashClip::clipToPath of the file splash/Spla... | 2026-09-30 |
| CVE-2026-102253 | high | 7.5 | No | iperf3 versions prior to 3.22 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash-loop the serv... | 2026-09-30 |
| CVE-2026-87004 | high | 8.1 | No | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.31.3, when the OIDC login flow completes, bac... | 2026-09-30 |
| CVE-2026-55494 | critical | 9.8 | No | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.4, Tugtainer Agent allows unauthenticated... | 2026-09-30 |
| CVE-2026-46711 | high | 8.3 | No | Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, the workspace HTTP servic... | 2026-09-30 |
| CVE-2026-80490 | not reported | — | No | Algorithm::AhoCorasick::XS versions through 0.04 for Perl read the haystack string length before the scalar is stringified. The matches, fi... | 2026-09-30 |
| CVE-2026-94545 | not reported | — | No | Satori is a library to convert HTML and CSS to SVG. Starting in version 0.0.27 and prior to version 0.33.5, Satori does not properly escape... | 2026-09-30 |
| CVE-2026-74865 | not reported | — | No | sogo_yhn configures SOGo with a parameter "SOGoTrustProxyAuthentication=YES". This causes the password to be bypassed during HTTP Basic auth... | 2026-09-30 |
| CVE-2026-74864 | not reported | — | No | sogo_yhn configures SOGo with a parameter that forces the request with HTTP header "x-webobjects-remote-user" to be treated as sent by a ver... | 2026-09-30 |
| CVE-2026-76992 | high | 7.5 | No | The CODESYS Gateway Client allocates memory based on a size field in a gateway response without enforcing an appropriate upper limit. An una... | 2026-09-30 |
| CVE-2026-79625 | high | 8.1 | No | Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, this... | 2026-09-30 |
| CVE-2026-93853 | not reported | — | No | Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrela... | 2026-09-30 |
| CVE-2026-68911 | not reported | — | No | Nicotine+ is a graphical client for the Soulseek peer-to-peer network. Prior to version 3.3.11, a modified remote client can send zlib-compr... | 2026-09-30 |
| CVE-2026-63209 | high | 7.5 | No | compress provides various compression algorithms. Prior to version 1.18.7, a signed integer overflow vulnerability in s2.NewDict() allows an... | 2026-09-30 |
| CVE-2026-85520 | not reported | — | No | Google Merchant Center Feed (gmfeed) module for PrestaShop is vulnerable to unauthenticated arbitrary file write in the feed.php endpoint. A... | 2026-09-30 |
| CVE-2026-41875 | not reported | — | No | Quick.Cart is vulnerable to Cross-Site Request Forgery in admin config panel. Malicious attacker can craft special website, which when visit... | 2026-09-30 |
| CVE-2026-84154 | critical | 9.9 | No | A Code Injection vulnerability affecting GEOVIA Geospatial Data Manager from Release 3DEXPERIENCE R2024x through Release 3DEXPERIENCE R2026x... | 2026-09-30 |
| CVE-2026-102277 | medium | 5.3 | No | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.21, 2.1.7, 3.0.9, and 5.0.12, th... | 2026-09-30 |
| CVE-2026-102276 | high | 7.5 | No | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.19, 2.1.5, 3.0.7, and 5.0.10, cr... | 2026-09-30 |
| CVE-2026-100392 | not reported | — | No | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, Users::form() performs... | 2026-09-30 |