Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107046 | medium | 5.3 | No | A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows attackers to scan inter... | 2026-11-02 |
| CVE-2026-107030 | high | 7.5 | No | Insecure permissions in craftxbox YubiClip XOR fork v1.0.1 (versionCode 10003) allows unauthorized attackers to trigger the OTP-clipboard (O... | 2026-11-02 |
| CVE-2026-107090 | high | 7.8 | No | An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary code via the Maltego Win... | 2026-11-02 |
| CVE-2026-107014 | critical | 9.1 | No | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'... | 2026-11-02 |
| CVE-2026-106677 | high | 7.1 | No | Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl. An authenticated user can view conversations, read messages,... | 2026-11-02 |
| CVE-2026-105602 | not reported | — | No | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11. | 2026-11-02 |
| CVE-2026-105601 | not reported | — | No | Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5 | 2026-11-02 |
| CVE-2026-105600 | not reported | — | No | Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5 | 2026-11-02 |
| CVE-2026-104598 | high | 7.5 | No | libosmo-sigtran through 2.2.1 contains an out-of-bounds read in the M3UA NOTIFY decoder in src/m3ua.c. This allows a remote attacker to obta... | 2026-11-02 |
| CVE-2026-106676 | medium | 5.4 | No | qiujie mall-server 0.0.1-SNAPSHOT contains an integer overflow in CartServiceImpl that allows an authenticated user to wrap a cart quantity... | 2026-11-02 |
| CVE-2026-103420 | not reported | — | No | Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5 | 2026-11-02 |
| CVE-2026-103419 | not reported | — | No | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11. | 2026-11-02 |
| CVE-2026-102802 | not reported | — | No | Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles Anywhere extension <... | 2026-11-02 |
| CVE-2026-102801 | not reported | — | No | Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1... | 2026-11-02 |
| CVE-2026-104593 | high | 7.5 | No | osmo-msc through 1.15.0 contains a stack-based buffer overflow in decode_mme_name() in src/libmsc/sgs_iface.c. This allows a remote attacker... | 2026-11-02 |
| CVE-2026-91283 | medium | 4.3 | No | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are a... | 2026-11-02 |
| CVE-2026-91284 | medium | 6.5 | No | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: E1 Dev Platform Tech - UNIX). Supported version... | 2026-11-02 |
| CVE-2026-115785 | medium | 4.3 | No | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary auth... | 2026-11-02 |
| CVE-2026-12617 | high | 7.5 | No | The issue is unexpected program termination based on ordering and/or specific content in responses to queries for CNAME or DNAME, and A reco... | 2026-11-02 |
| CVE-2026-115786 | medium | 6.5 | No | A mailbox quota-accounting vulnerability in Zimbra Collaboration Suite (ZCS) allows an authenticated user to consume another user’s mailbox... | 2026-11-02 |