Known Exploited Vulnerabilities (KEV)
ndaal KEV
| ID | Title | Severity | CVSS | EPSS | Source | Updated |
|---|---|---|---|---|---|---|
| cve-2026-56091 | When using Apache Shiro with the shiro-guice module in a web servlet context, a specially crafted HTTP request may ca... | HIGH | 8.2 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-55971 | thrift: Apache Thrift C++ bindings: Remote code execution via heap-based buffer overflow | HIGH | 8.4 | N/A | cvelistv5 | 2026-08-07 |
| cve-2026-55970 | Buffer Over-read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. User... | MEDIUM | 6.9 | N/A | cvelistv5 | 2026-10-24 |
| cve-2026-55969 | SUSE CVE CVE-2026-55969 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-07-28 |
| cve-2026-55968 | Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thri... | HIGH | 8.7 | N/A | cvelistv5 | 2026-10-24 |
| cve-2026-55957 | Missing Critical Step in Authentication vulnerability in Apache Tomcat when the JNDIRealm was configured to authentic... | HIGH | 7.3 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-55953 | SUSE CVE CVE-2026-55953 | HIGH | 7.4 | N/A | cvelistv5 | 2026-09-09 |
| cve-2026-55858 | SUSE CVE CVE-2026-55858 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-09-03 |
| cve-2026-55851 | SUSE CVE CVE-2026-55851 | HIGH | 7.5 | N/A | cvelistv5 | 2026-09-09 |
| cve-2026-55737 | SUSE CVE CVE-2026-55737 | MEDIUM | 4.0 | N/A | cvelistv5 | 2026-09-10 |
| cve-2026-5545 | SUSE CVE CVE-2026-5545 | MEDIUM | 6.5 | N/A | cvelistv5 | 2026-09-11 |
| cve-2026-55200 | libssh2 1.11.1, fixed in commit 97acf3d, contains an out-of-bounds write vulnerability in ssh2_transport_read() that ... | CRITICAL | 9.2 | N/A | cvelistv5 | 2026-10-22 |
| cve-2026-55199 | libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message | MEDIUM | 5.9 | N/A | cvelistv5 | 2026-07-05 |
| cve-2026-54906 | concurrent-ruby is a modern concurrency tools for Ruby | LOW | 2.1 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-54905 | concurrent-ruby is a modern concurrency tools for Ruby | LOW | 2.0 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-54904 | concurrent-ruby is a modern concurrency tools for Ruby | HIGH | 8.2 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-54890 | SUSE CVE CVE-2026-54890 | MEDIUM | 5.9 | N/A | cvelistv5 | 2026-09-10 |
| cve-2026-54876 | SUSE CVE CVE-2026-54876 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-08-31 |
| cve-2026-54874 | SUSE CVE CVE-2026-54874 | MEDIUM | 5.3 | N/A | cvelistv5 | 2026-09-19 |
| cve-2026-54428 | Allocation of resources without limits or throttling in the HTTP/2 HPACK decoder in Apache HttpComponents Core (5.4.2... | HIGH | 7.5 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-54399 | Uncontrolled Resource Consumption vulnerability in the HTTP/1.1 message parser in Apache HttpComponents Core (5.4.2 ... | HIGH | 7.5 | N/A | cvelistv5 | 2026-10-25 |
| cve-2026-54291 | SUSE CVE CVE-2026-54291 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-07-07 |
| cve-2026-49268 | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapReal... | HIGH | 8.8 | N/A | cvelistv5 | 2026-10-26 |
| cve-2026-49158 | SUSE CVE CVE-2026-49158 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-07-28 |
| cve-2026-4873 | curl: curl: Information disclosure due to incorrect TLS connection reuse | MEDIUM | 5.3 | N/A | cvelistv5 | 2026-09-01 |
| cve-2026-48589 | apache-shiro: shiro-jakarta-ee: Apache Shiro Jakarta EE module: Open Redirect via insufficient HTTP Referer header validation | MEDIUM | 4.6 | N/A | cvelistv5 | 2026-06-30 |
| cve-2026-48586 | SUSE CVE CVE-2026-48586 | HIGH | 7.5 | N/A | cvelistv5 | 2026-08-17 |
| cve-2026-48145 | SUSE CVE CVE-2026-48145 | HIGH | 7.5 | N/A | cvelistv5 | 2026-08-07 |
| cve-2026-48144 | SUSE CVE CVE-2026-48144 | UNKNOWN | N/A | N/A | cvelistv5 | 2026-07-28 |
| cve-2026-47893 | Spring Framework Request Headers Included in Exception Reasons in HandshakeWebsocketService | HIGH | 7.5 | N/A | cvelistv5 | 2026-09-01 |