Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104895 | high | 7.5 | No | The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] b... | 2026-11-04 |
| CVE-2026-104016 | high | 7.5 | No | ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) | 2026-11-04 |
| CVE-2026-103995 | not reported | — | No | Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in misinterpreting HTTP response co... | 2026-11-04 |
| CVE-2026-105477 | not reported | — | No | A vulnerability in Veeam Agent for Linux allows for local privilege escalation. Only installations that are managed by a Veeam Backup & Repl... | 2026-11-04 |
| CVE-2026-104381 | not reported | — | No | A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an unauthenticated attacker positio... | 2026-11-04 |
| CVE-2026-102664 | high | 7.1 | No | ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Prior to 3.0.10, 3.1.10, and 4.0.10, decompress_mysql_payload() in lib/m... | 2026-11-04 |
| CVE-2026-102816 | not reported | — | No | An authorization vulnerability exists in the country or region configuration interface of TP-Link RE305 V3. An unauthenticated attacker on t... | 2026-11-04 |
| CVE-2026-102638 | high | 7.1 | No | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Library Manager after the... | 2026-11-04 |
| CVE-2026-102637 | high | 7.1 | No | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invoked by a user, can t... | 2026-11-04 |
| CVE-2026-103594 | not reported | — | No | A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote attacker that has man-in-the... | 2026-11-04 |
| CVE-2026-102800 | not reported | — | No | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles quote() was applied on insert, which protects the SQ... | 2026-11-04 |
| CVE-2026-102340 | high | 8.5 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager gRPC API on po... | 2026-11-04 |
| CVE-2026-102339 | high | 8.2 | No | Telepresence enables local development against a remote Kubernetes or OpenShift cluster. Prior to 2.31.0, the Traffic Manager Tunnel gRPC st... | 2026-11-04 |
| CVE-2025-71457 | critical | 9.8 | No | vtenext 25.02 before 25.02.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to change any account pas... | 2026-11-04 |
| CVE-2025-71456 | high | 8.1 | No | vtenext before 25.02.2 contains an SQL injection vulnerability that allows authenticated low-privileged users to inject SQL by supplying a c... | 2026-11-04 |
| CVE-2025-71455 | medium | 5.3 | No | vtenext before 25.02.2 contains a session identifier disclosure vulnerability that allows attackers to read the PHPSESSID value returned by... | 2026-11-04 |
| CVE-2026-102636 | high | 7.1 | No | A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can trigger a Stored Cr... | 2026-11-04 |
| CVE-2025-71454 | medium | 6.5 | No | vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrf_check() in include/utils/VteCsrf.php skips __csr... | 2026-11-04 |
| CVE-2025-71453 | medium | 6.1 | No | vtenext before 25.02.2 contains a reflected cross-site scripting vulnerability in modules/Home/HomeWidgetBlockList.php that echoes unsanitiz... | 2026-11-04 |
| CVE-2024-7885 | high | 7.5 | No | A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. T... | 2026-11-04 |