CVSS 9.3

Everything Threat Times has reported about CVSS 9.3: 6 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

Qexo vulnerability allows unauthenticated users to reset blog configuration and expose credentials

Threat TimesOct 12, 2026

A critical flaw in Qexo versions prior to 4.2.0 enables attackers to bypass authentication and potentially steal stored service credentials via the setup API.

Vulnerabilities

Critical Container Escape Flaw Found in sandboxed.sh Versions Up to 1.3.0

Threat TimesOct 12, 2026

A critical vulnerability in sandboxed.sh allows container workspaces to access host filesystems, posing severe risks to isolated environments.

Vulnerabilities

Agnaistic agnai 1.0.555 Vulnerable to Critical Hardcoded Credential Flaw

Threat TimesOct 11, 2026

A critical vulnerability in Agnaistic agnai allows unauthenticated attackers to gain admin access via hardcoded credentials and JWT secrets.

Vulnerabilities

openapi-typescript-codegen Critical Code Injection Flaw Exposes Devs to Arbitrary JS Execution

Threat TimesOct 10, 2026

A critical vulnerability in openapi-typescript-codegen allows attackers to inject JavaScript via OpenAPI documents, affecting versions up to 0.31.0.

Vulnerabilities

Critical Hazelcast Flaw Allows Arbitrary Memory Reads and Remote Code Execution

Threat TimesOct 8, 2026

CVE-2026-107726 enables malicious clients to crash cluster members and execute code via improper data validation in Java heap and JVM memory.

Vulnerabilities

Critical Auth Bypass in Integrics Enswitch Allows Password Takeover

Threat TimesOct 8, 2026

Unauthenticated attackers can reset admin passwords in Integrics Enswitch versions up to 4.4 by exploiting a logic flaw in the password update API endpoint.