Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-24317 | medium | 5.0 | No | SAP GUI for Windows allows DLL files to be loaded from arbitrary directories within the application. An unauthenticated attacker could explo... | 2026-11-03 |
| CVE-2026-25941 | high | 8.1 | No | FreeRDP is a free implementation of the Remote Desktop Protocol. Versions on the 2.x branch prior to to 2.11.8 and on the 3.x branch prior t... | 2026-11-03 |
| CVE-2026-25929 | medium | 6.5 | No | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the documen... | 2026-11-03 |
| CVE-2026-20523 | high | 8.4 | No | In neuropilot, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with... | 2026-11-03 |
| CVE-2026-18444 | high | 7.8 | No | There is an integer conversion vulnerability resulting in an out-of-bounds read when loading images recently discovered in NI LabVIEW. This... | 2026-11-03 |
| CVE-2026-17024 | critical | 9.8 | No | IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to execute arbitrary code due to improper certificate validation... | 2026-11-03 |
| CVE-2026-13477 | high | 8.8 | No | IBM QRadar 7.6.0.0 through 7.6.0.1, and 7.5.0 through 7.5.0 UP 15 Interim Fix 005 could allow an authenticated privileged user to execute ar... | 2026-11-03 |
| CVE-2026-15343 | not reported | — | No | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed an attacker with code execution inside a Dependabot u... | 2026-11-03 |
| CVE-2026-121736 | medium | 5.3 | No | NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize handler that allows unau... | 2026-11-03 |
| CVE-2026-121735 | low | 3.7 | No | blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows attackers to confirm acco... | 2026-11-03 |
| CVE-2026-121732 | low | 2.7 | No | RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to assign fees and payments... | 2026-11-03 |
| CVE-2026-12489 | medium | 6.5 | No | An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through 5.44(ACHR.6)C0 could al... | 2026-11-03 |
| CVE-2026-121731 | high | 8.8 | No | RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including parents, to inject SQL... | 2026-11-03 |
| CVE-2026-121728 | medium | 5.3 | No | SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to register... | 2026-11-03 |
| CVE-2026-121727 | high | 7.5 | No | Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated attackers to bypass... | 2026-11-03 |
| CVE-2026-121582 | medium | 6.5 | No | A vulnerability has been found in Umami up to 3.4.1. Impacted is an unknown function of the file src/app/api/record/route.ts of the componen... | 2026-11-03 |
| CVE-2026-121581 | medium | 4.3 | No | A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.0. The impacted element is an unknown function of the file /api/v1/providers/{i... | 2026-11-03 |
| CVE-2026-121628 | low | 3.7 | No | Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem sin... | 2026-11-03 |
| CVE-2026-121624 | medium | 6.8 | No | Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent a... | 2026-11-03 |
| CVE-2026-121531 | medium | 6.3 | No | A vulnerability has been found in Umami 3.3.x/3.4.0/3.4.1. This affects an unknown part of the file src/app/api/auth/login/route.ts of the c... | 2026-11-03 |