Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103327 | medium | 5.3 | No | The CryptoCloud WordPress plugin from 3.0.0 through 3.0.1 does not verify the authenticity of the payment notifications received by its gate... | 2026-11-04 |
| CVE-2026-106465 | not reported | — | No | In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603, the NetX Secure DTLS server never compares the cookie a client returns with t... | 2026-11-04 |
| CVE-2026-106464 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the NetX Secure X.509 parser accepts a certificate whose signature is... | 2026-11-04 |
| CVE-2026-102730 | not reported | — | No | Mounting an attacker-controlled NAND flash image (`lx_nand_flash_open()`) triggers an unbounded out-of-bounds heap **write** in LevelX's NAN... | 2026-11-04 |
| CVE-2026-102718 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the SNMP agent's OID parser uses a multi-byte BER length from the req... | 2026-11-04 |
| CVE-2026-102716 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the RTSP server returns a raw parser error for a malformed Session he... | 2026-11-04 |
| CVE-2026-91360 | medium | 6.5 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-91359 | medium | 5.3 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-102715 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for... | 2026-11-04 |
| CVE-2026-102714 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area t... | 2026-11-04 |
| CVE-2026-0637 | medium | 5.4 | No | When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without... | 2026-11-04 |
| CVE-2026-91361 | medium | 5.3 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-118775 | medium | 5.3 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/... | 2026-11-04 |
| CVE-2026-111040 | not reported | — | No | The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inj... | 2026-11-04 |
| CVE-2026-111038 | not reported | — | No | CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because... | 2026-11-04 |
| CVE-2026-111037 | not reported | — | No | A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability ari... | 2026-11-04 |
| CVE-2026-111036 | not reported | — | No | Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functio... | 2026-11-04 |
| CVE-2026-19731 | low | 3.3 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Researc... | 2026-11-04 |
| CVE-2026-19721 | low | 3.3 | No | Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allow... | 2026-11-04 |
| CVE-2026-114426 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without... | 2026-11-04 |