Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-17038 | not reported | — | No | DrEryk Gabinet before 11.5.0 uses hard-coded API credentials in its ticket reporting component. These credentials can be used to authenticat... | 2026-09-10 |
| CVE-2026-87806 | high | 7.4 | No | Parse Server versions <= 8.6.87 and >= 9.0.0 < 9.10.1-alpha.7 contain an authentication bypass in the built-in LDAP authentication adapter.... | 2026-09-10 |
| CVE-2026-86776 | low | 3.3 | No | KeePass versions 2.35 through 2.61.1 fail to validate KDBX header field sizes before memory allocation in the ReadHeaderField function. Atta... | 2026-09-10 |
| CVE-2026-86547 | medium | 6.2 | No | mrubyc through 4.0.0 contains a null pointer dereference vulnerability in the op_enter() handler in src/vm.c when processing untrusted bytec... | 2026-09-10 |
| CVE-2026-55250 | not reported | — | No | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.74.0 has a high-severity Token Replay Vulnerability aris... | 2026-09-10 |
| CVE-2026-53933 | not reported | — | No | Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. Wh... | 2026-09-10 |
| CVE-2026-81192 | high | 7.0 | No | `OpenTelemetry.Resources.Host` NuGet package, which provides OpenTelemetry resource detectors for host, is affected by an untrusted search p... | 2026-09-10 |
| CVE-2026-86259 | high | 7.5 | No | OpenMAIC before 1.0.1 skips server-side request forgery validation in non-production builds, allowing unauthenticated attackers to reach clo... | 2026-09-10 |
| CVE-2026-88038 | medium | 4.8 | No | cookies is a Node.js library for reading and writing HTTP cookies, used by Koa via ctx.cookies. In versions before 0.9.2 the library validat... | 2026-09-10 |
| CVE-2026-53939 | critical | 9.1 | No | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). In versions 0.6.1 through 0.6.2.5, when cjose... | 2026-09-10 |
| CVE-2026-53938 | high | 8.2 | No | OpenIDC/cjose is a C library implementing the Javascript Object Signing and Encryption (JOSE). Prior to version 0.6.2.5, cjose's JWE decrypt... | 2026-09-10 |
| CVE-2026-89046 | high | 8.2 | No | zstd-jni versions 1.5.5-6 through 1.5.7-13 contain an out-of-bounds read vulnerability in Zstd.getFrameContentSize that fails to validate ne... | 2026-09-10 |
| CVE-2026-88055 | medium | 5.5 | No | AnythingLLM is an application that turns pieces of content into context that any LLM can use as references during chatting. In 1.16.1 and ea... | 2026-09-10 |
| CVE-2026-15419 | not reported | — | No | In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packe... | 2026-09-10 |
| CVE-2026-15418 | not reported | — | No | In the silabser.sys driver for CP210x devices v11.5.0 and earlier, a local unprivileged user with a malicious device can use malformed packe... | 2026-09-10 |
| CVE-2026-15417 | not reported | — | No | In the silabser.sys Windows 8 driver for CP210x devices, a local unprivileged user can use incorrect driver settings to cause a kernel crash... | 2026-09-10 |
| CVE-2026-88045 | high | 7.5 | No | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.75.0 until 1.75.1, the... | 2026-09-10 |
| CVE-2026-88044 | critical | 9.1 | No | rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.70.0 until 1.75.1, the... | 2026-09-10 |
| CVE-2026-85228 | critical | 9.1 | No | An integer overflow in the tensor buffer validation component in Amazon Deep Java Library (DJL) from 0.13.0 through 0.36.0 on all platforms... | 2026-09-10 |
| CVE-2026-68488 | critical | 9.9 | No | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root... | 2026-09-10 |