ENISA

Reports to ENISA (27)

Latest CVEs (this partner and the CNAs under it) · RSS

• CVE-2026-106030 2026-10-16 · CERT-PL · CVSS 6.8
  NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to Manual via named pipes. The NordVPN user
• CVE-2026-111458 2026-10-16 · CIRCL · CVSS 6.8
  The fanx_fingerprint function in ssl/sslxprint.c of ssldump allocates a heap buffer for formatting FAN/1 X.509 certificate fingerprints. The allocation size is
• CVE-2026-88794 2026-10-15 · CERT-PL · CVSS 8.2
  Enterprise Architect is vulnerable to XML External Entity (XXE) injection in the XSLT Debugger feature. When a user loads a crafted XML file containing a `DOCTY
• CVE-2026-63315 2026-10-15 · CERT-PL · CVSS 8.2
  WebCTI service for Slican IPx telephone exchanges stores temporary subscriber password in plaintext. An attacker with access to the database can obtain the user
• CVE-2026-63314 2026-10-15 · CERT-PL · CVSS 8.7
  WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in /webcti/admin_json.php enpoint. Improper neutralization of input allows an a
• CVE-2026-35088 2026-10-15 · CERT-PL · CVSS 8.2
  Slican telephone exchanges use symmetric encryption for TCP/IP communication. Secret key is hardcoded in multiple binary files. An attacker who has access to th
• CVE-2026-103905 2026-10-14 · CVSS 8.7
  The authentication middleware of the JTL-Shop administration backend processes the plugin safe mode toggle on the admin logout route before checking whether the
• CVE-2026-103904 2026-10-14 · CVSS 8.6
  The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent ite
• CVE-2026-89310 2026-10-14 · CVSS 9.4
  A parameter taken from the request body is inserted into a T-SQL statement without parameterization or escaping, allowing a remote attacker to execute arbitrary
• CVE-2026-63316 2026-10-13 · CERT-PL · CVSS 8.7
  A SQL injection vulnerability has been identified in Payload CMS. Improper neutralization of input provided by user into "in" and "not_in" query paramethers all
• CVE-2026-89309 2026-10-13 · CVSS 10.0
  The authorization middleware of the WMS MobileServer fails to require authentication in two distinct cases. First, it only requires an Authorization header for
• CVE-2026-103316 2026-10-13 · NCSC-NL · CVSS 7.1
  The macOS version of the DigiD app is not signed with Hardened Runtime. As a result, a local process can load its own dylib into DigiD via DYLD_INSERT_LIBRARIES
• CVE-2026-103903 2026-10-12 · CVSS 8.7
  An incorrect authorization vulnerability in the WinBox authentication flow of MikroTik RouterOS allows a remote authenticated attacker with credentials for a lo
• CVE-2026-103902 2026-10-12 · CVSS 7.5
  Improper verification of cryptographic signature vulnerability in DigiDoc libdigidocpp, DigiDoc DigiDoc4, DigiDoc DigiDoc Android, and DigiDoc DigiDoc iOS. The
• CVE-2026-103663 2026-10-08 · CERT-PL · CVSS 6.9
  Ollama is vulnerable to path traversal in the `/api/pull` endpoint due to insufficient validation of layer digests by the `digestToPath` function. An unauthenti
• CVE-2026-107278 2026-10-07 · CIRCL · CVSS 5.3
  MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originat
• CVE-2026-107276 2026-10-07 · CIRCL · CVSS 6.3
  MISP contains a race condition in the email-based one-time password (OTP) login flow. When two HTTP requests carrying the same valid OTP are submitted concurren
• CVE-2026-33586 2026-10-07 · CVSS 6.3
  Authenticated users are able to manipulate both the SMTP envelope “Envelope-from” and “From” fields when sending emails through OVH mail servers. Due to OVH'
• CVE-2026-107180 2026-10-07 · CIRCL · CVSS 7.1
  On MISP instances configured to require TOTP enrolment (Security.otp_required), the enforcement of the mandatory two-factor authentication setup applied only to
• CVE-2026-107175 2026-10-07 · CIRCL · CVSS 5.3
  MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sha
• CVE-2026-106513 2026-10-06 · CIRCL · CVSS 6.9
  MISP exposes critical infrastructure settings—specifically the Redis host addresses used by the core application, the ZeroMQ plugin, and the SimpleBackgroundJob
• CVE-2026-106512 2026-10-06 · CIRCL · CVSS 8.4
  The CakeResponse::download() method in lib/Cake/Network/CakeResponse.php constructs a Content-Disposition header by directly interpolating a caller-supplied fil
• CVE-2025-8352 2026-10-06 · ESET · CVSS 6.9
  Allocation of resources without limits or throttling vulnerability in ESET PROTECT On-Prem increased resource consumption (CPU and RAM), leading to conditions f
• CVE-2026-75820 2026-10-06 · CERT-PL · CVSS 1.8
  GNU Aspell contains an integer truncation vulnerability in the WritableDict::add() function in modules/speller/default/writable.cpp. When loading a personal wor
• CVE-2026-75819 2026-10-06 · CERT-PL · CVSS 1.8
  GNU Aspell contains an out-of-bounds read vulnerability in ReadOnlyDict::load() in readonly_ws.cpp. When loading a binary .rws dictionary file, it uses offset f