Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101171 | low | 3.6 | No | Permission control vulnerability in the background task management module. Impact: Successful exploitation of this vulnerability may affect... | 2026-11-02 |
| CVE-2026-101170 | medium | 4.0 | No | DoS vulnerability in the file parsing module. Impact: Successful exploitation of this vulnerability may affect availability. | 2026-11-02 |
| CVE-2025-48600 | medium | 5.5 | No | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local in... | 2026-11-02 |
| CVE-2025-22442 | high | 7.0 | No | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created... | 2026-11-02 |
| CVE-2024-7075 | medium | 4.6 | No | The user search function within the management console fails to properly encode user-supplied input before rendering it in the browser. This... | 2026-11-02 |
| CVE-2024-5617 | medium | 4.8 | No | The account lock feature fails to correctly enforce account lockouts on the primary user store when users with identical usernames exist in... | 2026-11-02 |
| CVE-2014-125138 | high | 8.8 | No | C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted file upload vulnerab... | 2026-11-02 |
| CVE-2013-20008 | medium | 6.8 | No | Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the administrator password without... | 2026-11-02 |
| CVE-2026-112681 | medium | 5.5 | No | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS 27.2.... | 2026-11-02 |
| CVE-2026-112707 | low | 3.3 | No | A privacy issue was addressed by moving sensitive data to a protected location. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.... | 2026-11-02 |
| CVE-2026-113950 | medium | 5.4 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate... | 2026-11-02 |
| CVE-2026-91276 | medium | 5.3 | No | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported... | 2026-11-02 |
| CVE-2026-91277 | medium | 5.3 | No | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported... | 2026-11-02 |
| CVE-2026-91285 | medium | 6.5 | No | Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security). Supported... | 2026-11-02 |
| CVE-2026-119735 | medium | 5.4 | No | Munshi (by Petpooja) before 2026-07-13 contained a stored cross-site scripting vulnerability that allows authenticated users to inject malic... | 2026-11-02 |
| CVE-2026-119731 | high | 7.5 | No | Munshi (by Petpooja) before 2026-06-30 contained a payment bypass vulnerability in its subscription payment webhook at POST /api/payment/ord... | 2026-11-02 |
| CVE-2026-105605 | not reported | — | No | Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3 - A “duplicate my ad”... | 2026-11-02 |
| CVE-2026-105604 | not reported | — | No | Joomla Extension - dj-extensions.com - Unauthenticated SQL injection in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vul... | 2026-11-02 |
| CVE-2026-105603 | not reported | — | No | Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds... | 2026-11-02 |
| CVE-2026-117067 | not reported | — | No | An out-of-bounds memory access vulnerability in the N2 SCTP interface of OpenAirInterface (OAI) CN5G AMF v2.2.1 allows an unauthenticated re... | 2026-11-02 |