Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-58649 | medium | 6.5 | No | Origin validation error in .NET allows an unauthorized attacker to disclose information over a network. | 2026-10-30 |
| CVE-2026-57200 | high | 7.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-30 |
| CVE-2026-57201 | high | 7.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-30 |
| CVE-2026-57188 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-30 |
| CVE-2026-57185 | medium | 6.5 | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-10-30 |
| CVE-2026-107312 | medium | 4.3 | No | Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive Allocation. This issue... | 2026-10-30 |
| CVE-2026-107311 | low | 3.7 | No | Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful Browsing. This issue affect... | 2026-10-30 |
| CVE-2026-107310 | medium | 4.3 | No | Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request Forgery. This issue affects Freelinking ve... | 2026-10-30 |
| CVE-2026-107309 | low | 3.7 | No | Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.... | 2026-10-30 |
| CVE-2026-107308 | low | 3.1 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country allows Cross-Site Scrip... | 2026-10-30 |
| CVE-2026-116672 | high | 8.8 | No | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint... | 2026-10-30 |
| CVE-2026-114620 | medium | 5.4 | No | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, Authlib's RFC 9101 JWTAuthenticationRequest passe... | 2026-10-30 |
| CVE-2026-114127 | not reported | — | No | Astro is a web framework for content-driven websites. From 7.1.0 until 7.3.3, Astro's server-side View Transition CSS generator does not kee... | 2026-10-30 |
| CVE-2026-107307 | medium | 4.3 | No | Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful Browsing. This issue affects SmartLinker AI versions: from 0.... | 2026-10-30 |
| CVE-2026-107306 | low | 3.8 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link Attributes allows Sto... | 2026-10-30 |
| CVE-2026-107262 | medium | 5.3 | No | Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery. This issue affects Advanced... | 2026-10-30 |
| CVE-2026-86987 | medium | 5.5 | No | An authorization issue was addressed with improved entitlement checks. This issue is fixed in iOS 27.2 and iPadOS 27.2. A remote attacker ma... | 2026-10-30 |
| CVE-2026-76287 | medium | 5.4 | No | In Splunk Enterprise versions below 10.4.4, a user that holds a role with the preview_data_management_pipeline capability or edit_data_manag... | 2026-10-30 |
| CVE-2026-76288 | high | 7.5 | No | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, an unauthenticated user could send a single crafted request to the... | 2026-10-30 |
| CVE-2026-76289 | medium | 6.5 | No | In Splunk Enterprise versions below 10.4.4, 10.2.8, 10.0.11, and 9.4.16, a user who does not hold the "admin" or "power" Splunk roles could... | 2026-10-30 |