Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104381 | not reported | — | No | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positio... | 2026-11-04 |
| CVE-2026-102664 | high | 7.1 | No | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/m... | 2026-11-04 |
| CVE-2026-102816 | not reported | — | No | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on t... | 2026-11-04 |
| CVE-2026-102638 | high | 7.1 | No | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the... | 2026-11-04 |
| CVE-2026-102637 | high | 7.1 | No | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can t... | 2026-11-04 |
| CVE-2026-103594 | not reported | — | No | A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the... | 2026-11-04 |
| CVE-2026-102800 | not reported | — | No | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, which protects the SQ... | 2026-11-04 |
| CVE-2026-102340 | high | 8.5 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on po... | 2026-11-04 |
| CVE-2026-102339 | high | 8.2 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC st... | 2026-11-04 |
| CVE-2026-102636 | high | 7.1 | No | A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cr... | 2026-11-04 |
| CVE-2024-7885 | high | 7.5 | No | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. T... | 2026-11-04 |
| CVE-2024-3657 | high | 7.5 | No | A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial... | 2026-11-04 |
| CVE-2024-3019 | high | 8.8 | No | A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command ex... | 2026-11-04 |
| CVE-2024-21886 | high | 7.8 | No | A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in... | 2026-11-04 |
| CVE-2024-1753 | high | 8.6 | No | A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into... | 2026-11-04 |
| CVE-2024-21885 | high | 7.8 | No | A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certa... | 2026-11-04 |
| CVE-2024-1635 | high | 7.5 | No | A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a malici... | 2026-11-04 |
| CVE-2024-1488 | high | 7.3 | No | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbo... | 2026-11-04 |
| CVE-2024-1249 | high | 7.4 | No | A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows at... | 2026-11-04 |
| CVE-2024-1132 | high | 8.1 | No | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to constru... | 2026-11-04 |