Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-59270 | critical | 9.1 | No | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its l... | 2026-09-01 |
| CVE-2026-75871 | critical | 9.6 | No | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.... | 2026-09-01 |
| CVE-2026-77070 | critical | 9.8 | No | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operation... | 2026-09-01 |
| CVE-2026-77071 | critical | 9.8 | No | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and... | 2026-09-01 |
| CVE-2026-65081 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A... | 2026-09-01 |
| CVE-2026-65098 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.... | 2026-09-01 |
| CVE-2019-3774 | critical | 9.8 | No | Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when rece... | 2026-09-01 |
| CVE-2026-65084 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation.... | 2026-09-01 |
| CVE-2026-84149 | not reported | — | No | This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unaut... | 2026-09-01 |
| CVE-2026-84148 | not reported | — | No | This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticate... | 2026-09-01 |
| CVE-2026-84147 | not reported | — | No | This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.... | 2026-09-01 |
| CVE-2026-18808 | critical | 9.8 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects... | 2026-09-01 |
| CVE-2026-18765 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-... | 2026-09-01 |
| CVE-2026-18210 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer... | 2026-09-01 |
| CVE-2026-39932 | critical | 9.1 | No | OpenEMR through 8.2.0 contains a remote code execution vulnerability in the document category tree component (library/classes/Tree.class.php... | 2026-09-01 |
| CVE-2026-5480 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descri... | 2026-09-01 |
| CVE-2020-29583 | not reported | — | Listed | Zyxel firewalls (ATP, USG, VM) and AP Controllers (NXC2500 and NXC5500) contain a use of hard-coded credentials vulnerability in an undocume... | — |
| CVE-2019-8394 | not reported | — | Listed | Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page custo... | — |
| CVE-2020-10189 | not reported | — | Listed | Zoho ManageEngine Desktop Central contains a file upload vulnerability that allows for unauthenticated remote code execution. | — |
| CVE-2021-40539 | not reported | — | Listed | Zoho ManageEngine ADSelfService Plus contains an authentication bypass vulnerability affecting the REST API URLs which allow for remote code... | — |