Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79879 | high | 8.8 | No | Memory corruption vulnerabilities in the affected interface of AOS-10 could lead to remote code execution by an unauthenticated adjacent att... | 2026-10-30 |
| CVE-2026-79878 | high | 8.8 | No | A command injection vulnerability in the AOS-8 command line interface accessed by the PAPI protocol could lead to unauthenticated remote cod... | 2026-10-30 |
| CVE-2026-79877 | high | 8.8 | No | A remote code execution vulnerability in the underlying operating system of AOS-10 could allow an unauthenticated adjacent attacker to execu... | 2026-10-30 |
| CVE-2026-79876 | critical | 9.3 | No | A sensitive information disclosure vulnerability in the Wi-Fi frame processing of AOS-10 could allow an unauthenticated adjacent attacker to... | 2026-10-30 |
| CVE-2026-79875 | critical | 9.3 | No | A vulnerability has been identified in the PAPI protocol of AOS-8 that could potentially allow an unauthenticated adjacent attacker to circu... | 2026-10-30 |
| CVE-2026-79858 | critical | 9.8 | No | An unauthenticated SQL injection vulnerability exists in the PAPI protocol in AOS-8. Successful exploitation could allow an unauthenticated... | 2026-10-30 |
| CVE-2026-79846 | critical | 10.0 | No | Command injection vulnerabilities exist in the affected interface of AOS-8 that could allow an unauthenticated remote attacker to run arbitr... | 2026-10-30 |
| CVE-2026-62331 | high | 8.2 | No | praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1... | 2026-10-30 |
| CVE-2026-68482 | medium | 5.3 | No | Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized... | 2026-10-30 |
| CVE-2026-62160 | not reported | — | No | Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global `LanguageMiddleware` in `server/language.go` passes the raw `Accept-... | 2026-10-30 |
| CVE-2026-61845 | not reported | — | No | Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts `CSS scientific... | 2026-10-30 |
| CVE-2026-59978 | high | 7.5 | No | AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated `?script=version` endpoint... | 2026-10-30 |
| CVE-2026-59396 | medium | 4.9 | No | A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it... | 2026-10-30 |
| CVE-2026-59387 | high | 8.8 | No | The Nginx routing configuration for Cloud Controller blocks unauthenticated access to /internal/v4/ and /internal/v5/ endpoints but omits an... | 2026-10-30 |
| CVE-2026-120007 | medium | 6.5 | No | NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by... | 2026-10-30 |
| CVE-2026-119763 | medium | 5.3 | No | changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublishe... | 2026-10-30 |
| CVE-2026-49442 | medium | 5.3 | No | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, a User Enumeration vulnerability allows an atta... | 2026-10-30 |
| CVE-2026-54532 | medium | 6.9 | No | CloudPirates Open Source Helm Charts is a collection of Helm charts. Prior to commit 271d415, pull_request_target workflow is vulnerable to... | 2026-10-30 |
| CVE-2026-119117 | medium | 6.5 | No | Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is co... | 2026-10-30 |
| CVE-2026-119086 | medium | 6.5 | No | Missing queue-set type validation in the queue-set selection system call in FreeRTOS-Kernel before V11.3.3 on MPU-enabled ports with queue s... | 2026-10-30 |