{
  "query": {
    "page": "22"
  },
  "count": 20,
  "total": 46824,
  "page": 22,
  "limit": 20,
  "updated": {
    "cves": "2026-10-06T16:45:50.826Z",
    "kev": "2026-10-06T16:44:50.689Z",
    "epss": "2026-10-06T12:57:42.533Z",
    "breaches": "2026-10-06T12:45:41.825Z",
    "posts": "2026-10-06T16:45:50.826Z"
  },
  "links": {
    "web": "https://spydr.io/threats?page=22",
    "next": "https://spydr.io/threats.json?page=23"
  },
  "warnings": [],
  "results": [
    {
      "id": "CVE-2026-89289",
      "url": "https://spydr.io/cve/CVE-2026-89289",
      "published": "2026-10-06T07:16:59.737Z",
      "modified": "2026-10-06T15:18:12.170Z",
      "score": 5.3,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "score_source": "CISA ADP",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [],
      "products": [
        "Fast Courier"
      ],
      "cwes": [
        "CWE-862"
      ],
      "description": "The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of any WooCommerce order by supplying its id."
    },
    {
      "id": "CVE-2026-86786",
      "url": "https://spydr.io/cve/CVE-2026-86786",
      "published": "2026-10-06T07:16:59.620Z",
      "modified": "2026-10-06T15:18:12.170Z",
      "score": 5.3,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "score_source": "CISA ADP",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [],
      "products": [
        "Slider Pro"
      ],
      "cwes": [
        "CWE-200"
      ],
      "description": "The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing unauthenticated users to retrieve the title, excerpt and permalink of non-public posts, including drafts, pending, scheduled, private and trashed posts, as well as post revisions and media metadata."
    },
    {
      "id": "CVE-2026-59358",
      "url": "https://spydr.io/cve/CVE-2026-59358",
      "published": "2026-10-06T07:16:59.460Z",
      "modified": "2026-10-06T16:00:36.547Z",
      "score": 7.6,
      "severity": "high",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "vmware.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Cloud Foundry"
      ],
      "products": [
        "Cloud Foundry UAA",
        "Cloud Foundry cf-deployment"
      ],
      "cwes": [
        "CWE-287"
      ],
      "description": "Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret. UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret. Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client."
    },
    {
      "id": "CVE-2026-59357",
      "url": "https://spydr.io/cve/CVE-2026-59357",
      "published": "2026-10-06T07:16:59.253Z",
      "modified": "2026-10-06T16:00:36.547Z",
      "score": 6.5,
      "severity": "medium",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "vmware.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Cloud Foundry"
      ],
      "products": [
        "Cloud Foundry UAA",
        "Cloud Foundry cf-deployment"
      ],
      "cwes": [
        "CWE-345"
      ],
      "description": "Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter. The issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_id, its effective privilege depends entirely on the shadow account’s group memberships, which can include administrative scopes such as clients.write. Exploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration — this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account."
    },
    {
      "id": "CVE-2026-57559",
      "url": "https://spydr.io/cve/CVE-2026-57559",
      "published": "2026-10-06T07:16:59.123Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory corruption while processing service requests."
    },
    {
      "id": "CVE-2026-57555",
      "url": "https://spydr.io/cve/CVE-2026-57555",
      "published": "2026-10-06T07:16:58.980Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory Corruption when executing system service routines due to improper handling of user input buffers."
    },
    {
      "id": "CVE-2026-57554",
      "url": "https://spydr.io/cve/CVE-2026-57554",
      "published": "2026-10-06T07:16:58.760Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory Corruption when asynchronous threads access shared performance counter data simultaneously during FastRPC invocations."
    },
    {
      "id": "CVE-2026-57546",
      "url": "https://spydr.io/cve/CVE-2026-57546",
      "published": "2026-10-06T07:16:58.630Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.5,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-126"
      ],
      "description": "Transient DOS when processing a continuous receive command with a zero-sized global configuration override."
    },
    {
      "id": "CVE-2026-57545",
      "url": "https://spydr.io/cve/CVE-2026-57545",
      "published": "2026-10-06T07:16:58.437Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-822"
      ],
      "description": "Memory corruption when processing draw objects of incorrect type during graphics command list execution."
    },
    {
      "id": "CVE-2026-57537",
      "url": "https://spydr.io/cve/CVE-2026-57537",
      "published": "2026-10-06T07:16:58.300Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization."
    },
    {
      "id": "CVE-2026-25302",
      "url": "https://spydr.io/cve/CVE-2026-25302",
      "published": "2026-10-06T07:16:58.040Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.1,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-347"
      ],
      "description": "Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed."
    },
    {
      "id": "CVE-2026-25291",
      "url": "https://spydr.io/cve/CVE-2026-25291",
      "published": "2026-10-06T07:16:57.893Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms."
    },
    {
      "id": "CVE-2026-25274",
      "url": "https://spydr.io/cve/CVE-2026-25274",
      "published": "2026-10-06T07:16:57.770Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 6.7,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-416"
      ],
      "description": "Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization."
    },
    {
      "id": "CVE-2026-25273",
      "url": "https://spydr.io/cve/CVE-2026-25273",
      "published": "2026-10-06T07:16:57.647Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 6.7,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Memory Corruption when processing camera operations due to out-of-bounds write during driver updates."
    },
    {
      "id": "CVE-2026-25272",
      "url": "https://spydr.io/cve/CVE-2026-25272",
      "published": "2026-10-06T07:16:57.490Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 6.7,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation."
    },
    {
      "id": "CVE-2026-25270",
      "url": "https://spydr.io/cve/CVE-2026-25270",
      "published": "2026-10-06T07:16:57.367Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 6.7,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver."
    },
    {
      "id": "CVE-2026-25269",
      "url": "https://spydr.io/cve/CVE-2026-25269",
      "published": "2026-10-06T07:16:57.207Z",
      "modified": "2026-10-06T15:17:17.950Z",
      "score": 6.7,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size."
    },
    {
      "id": "CVE-2026-25267",
      "url": "https://spydr.io/cve/CVE-2026-25267",
      "published": "2026-10-06T07:16:56.997Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 7.8,
      "severity": "high",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-862"
      ],
      "description": "Memory corruption when non-secure loader rewrites page tables before secure memory initialization."
    },
    {
      "id": "CVE-2026-25263",
      "url": "https://spydr.io/cve/CVE-2026-25263",
      "published": "2026-10-06T07:16:56.747Z",
      "modified": "2026-10-06T15:08:38.397Z",
      "score": 6.6,
      "severity": "medium",
      "cvss_version": "3.1",
      "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L",
      "score_source": "qualcomm.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": "none",
      "vendors": [
        "Qualcomm, Inc."
      ],
      "products": [
        "Qualcomm, Inc. Snapdragon"
      ],
      "cwes": [
        "CWE-787"
      ],
      "description": "Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters."
    },
    {
      "id": "CVE-2026-105778",
      "url": "https://spydr.io/cve/CVE-2026-105778",
      "published": "2026-10-06T07:16:56.547Z",
      "modified": "2026-10-06T15:04:52.637Z",
      "score": 8.6,
      "severity": "high",
      "cvss_version": "4.0",
      "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "score_source": "vuldb.com",
      "epss": null,
      "epss_percentile": null,
      "exploited": false,
      "kev": null,
      "ssvc_exploitation": null,
      "vendors": [
        "Tenda"
      ],
      "products": [
        "Tenda AC5"
      ],
      "cwes": [
        "CWE-119",
        "CWE-121"
      ],
      "description": "A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
    }
  ],
  "attribution": [
    {
      "source": "NVD",
      "url": "https://nvd.nist.gov",
      "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD."
    },
    {
      "source": "CISA KEV",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "notice": "Known exploited vulnerabilities from the CISA KEV catalog."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss",
      "notice": "Exploit prediction scores from FIRST EPSS."
    }
  ]
}