Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115357 | low | 2.2 | No | OpenBao before 2.6.4 and 2.7.x before 2.7.1 fails to write response audit entries for the unauthenticated sys/generate-root, sys/rekey, and... | 2026-11-04 |
| CVE-2026-110935 | high | 8.4 | No | The PFI plugin framework deployment routine does not validate path components when extracting archive entries to the local plugin repository... | 2026-11-04 |
| CVE-2026-110022 | high | 8.4 | No | The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin repository and loads them v... | 2026-11-04 |
| CVE-2026-110021 | medium | 6.2 | No | PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue` over canonicalized `S... | 2026-11-04 |
| CVE-2026-112346 | critical | 9.8 | No | OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the DockerWorkspace and App... | 2026-11-04 |
| CVE-2006-4339 | critical | 9.1 | No | A flaw was found in OpenSSL. When configured to use an RSA key with exponent 3, OpenSSL improperly removes PKCS-1 padding before generating... | 2026-11-04 |
| CVE-2025-61478 | high | 7.5 | No | An issue in Vanderbilt Industries, Acre Security SPC5300.000 Main Board v.3.14.1 allows a physically proximate attacker to cause a denial of... | 2026-11-04 |
| CVE-2025-51675 | high | 7.5 | No | An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a... | 2026-11-04 |
| CVE-2025-56352 | high | 7.5 | No | In tinyMQTT commit 6226ade15bd4f97be2d196352e64dd10937c1962 (2024-02-18), the broker mishandles protocol violations during CONNECT packet pa... | 2026-11-04 |
| CVE-2025-67031 | medium | 6.3 | No | ORSEE (Online Recruitment System for Economic Experiments) 3.1.0 contains an authenticated Remote Code Execution vulnerability in the partic... | 2026-11-04 |
| CVE-2025-69443 | medium | 6.3 | No | Remote Code Execution in coleam00 Archon 0.1.0. A crafted HTML page, when accessed by a victim, can execute commands, run prompts on behalf... | 2026-11-04 |
| CVE-2025-27853 | high | 7.3 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows its authentication to be bypassed. The WDU web site only performs... | 2026-11-04 |
| CVE-2025-27852 | medium | 5.0 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a reflected cross site scripting (XSS) attack. This allows an att... | 2026-11-04 |
| CVE-2025-27851 | critical | 9.3 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a cross-site origin WebSocket hijacking attack. Among other uses,... | 2026-11-04 |
| CVE-2025-27850 | high | 7.5 | No | The locally served web site on the Garmin WDU (v1 1.4.6 and v2 5.0) allows a symlink attack. If a malicious graphics package containing syml... | 2026-11-04 |
| CVE-2025-70842 | medium | 5.4 | No | A Stored Cross-Site Scripting (XSS) vulnerability was discovered in the File Management module of FluentCMS 1.2.3. The flaw allows an authen... | 2026-11-04 |
| CVE-2025-61311 | high | 7.3 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_alerts.php component of GmbH Mecury Managed Print Services (docuForm) v1... | 2026-11-04 |
| CVE-2025-61310 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the acc-menu_billings.php component of GmbH Mecury Managed Print Services (docuForm)... | 2026-11-04 |
| CVE-2025-61309 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_departments.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |
| CVE-2025-61308 | medium | 6.1 | No | A reflected cross-site scripted (XSS) vulnerability in the dfm-menu_maintenance.php component of GmbH Mecury Managed Print Services (docuFor... | 2026-11-04 |