Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100694 | medium | 6.1 | No | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered wit... | 2026-09-30 |
| CVE-2026-100690 | high | 7.5 | No | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model t... | 2026-09-30 |
| CVE-2026-100678 | medium | 6.5 | No | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to gue... | 2026-09-30 |
| CVE-2026-100308 | high | 7.8 | No | Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to... | 2026-09-30 |
| CVE-2026-73192 | medium | 6.1 | No | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getVali... | 2026-09-30 |
| CVE-2026-102510 | not reported | — | No | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go imple... | 2026-09-30 |
| CVE-2026-102509 | not reported | — | No | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation o... | 2026-09-30 |
| CVE-2026-102508 | not reported | — | No | Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an... | 2026-09-30 |
| CVE-2026-91852 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects... | 2026-09-30 |
| CVE-2026-94053 | critical | 9.1 | No | Authentication bypass via LDAP injection in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apac... | 2026-09-30 |
| CVE-2026-94052 | critical | 9.1 | No | A missing check in LdapPasswordAuthenticator in component sshd-ldap in Apache MINA SSHD versions 1.2.0 to 2.19.0 or 3.0.0-M1 to 3.0.0-M5 byp... | 2026-09-30 |
| CVE-2026-94002 | high | 7.5 | No | Possible memory exhaustion in SFTP clients (DefaultSftpClient) in component sshd-sftp in Apache MINA SSHD versions 0.9.0 to 2.19.0 and 3.0.0... | 2026-09-30 |
| CVE-2026-93996 | medium | 6.5 | No | Uncontrolled resource consumption in component ssd-scp in Apache MINA SSHD versions up to 2.19.0 or 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD i... | 2026-09-30 |
| CVE-2026-93995 | medium | 6.5 | No | Improper input validation in sshd-git in Apache MINA SSHD, versions up to 2.19.0 and 3.0.0-M1 to 3.0.0-M5. Apache MINA SSHD is a Java libra... | 2026-09-30 |
| CVE-2026-93994 | high | 8.1 | No | Apache MINA SSHD is a Java library for client-side and server-side SSH. SSH servers can be configured to require multi-authentication scheme... | 2026-09-30 |
| CVE-2026-91928 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects... | 2026-09-30 |
| CVE-2026-103012 | not reported | — | No | Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead... | 2026-09-30 |
| CVE-2026-91999 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects... | 2026-09-30 |
| CVE-2026-18870 | medium | 4.3 | No | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3... | 2026-09-30 |
| CVE-2026-92001 | medium | 6.1 | No | Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Sling XSS. This issue affects... | 2026-09-30 |