Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91360 | medium | 6.5 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-91359 | medium | 5.3 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-102715 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, the mDNS add-on's string cache accepts a shorter name as a match for... | 2026-11-04 |
| CVE-2026-102714 | not reported | — | No | In Eclipse ThreadX NetX Duo versions up to and including 6.5.2.202603, built with IPv6, the ICMPv6 option validator accepts an option area t... | 2026-11-04 |
| CVE-2026-0637 | medium | 5.4 | No | When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without... | 2026-11-04 |
| CVE-2026-91361 | medium | 5.3 | No | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that a... | 2026-11-04 |
| CVE-2026-118775 | medium | 5.3 | No | Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, asn1.oidToDer() in lib/... | 2026-11-04 |
| CVE-2026-111040 | not reported | — | No | The platform allows persistent HTML injection into editable fields managed by TinyMCE. An authenticated attacker with low privileges can inj... | 2026-11-04 |
| CVE-2026-111038 | not reported | — | No | CSV formula injection vulnerability in the export functionality of the Coupa Supplier Portal SaaS platform. The vulnerability arises because... | 2026-11-04 |
| CVE-2026-111037 | not reported | — | No | A reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. The vulnerability ari... | 2026-11-04 |
| CVE-2026-111036 | not reported | — | No | Server-side request forgery (SSRF) vulnerability in the Coupa Supplier Portal SaaS platform, specifically in the document conversion functio... | 2026-11-04 |
| CVE-2026-19731 | low | 3.3 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software Technologies Researc... | 2026-11-04 |
| CVE-2026-19721 | low | 3.3 | No | Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute İmzager allow... | 2026-11-04 |
| CVE-2026-114426 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating the caller and without... | 2026-11-04 |
| CVE-2026-114425 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer attachment metadata. An u... | 2026-11-04 |
| CVE-2026-114424 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or recipient replacemen... | 2026-11-04 |
| CVE-2026-114421 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose initial password is... | 2026-11-04 |
| CVE-2026-114420 | not reported | — | No | SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated account-selection input in its GIN... | 2026-11-04 |
| CVE-2026-108946 | not reported | — | No | Improper input validation vulnerability in Apache ActiveMQ, Apache ActiveMQ KahaDB. The ActiveMQ broker resolves connection, session and co... | 2026-11-04 |
| CVE-2026-108500 | not reported | — | No | Input validation vulnerability in Apache ActiveMQ configured to use the LDAPAuthorizationMapPlugin allows an authenticated attacker to creat... | 2026-11-04 |