Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109365 | low | 3.7 | No | Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verific... | 2026-10-15 |
| CVE-2026-109364 | medium | 5.3 | No | Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavio... | 2026-10-15 |
| CVE-2026-109363 | high | 7.5 | No | ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation du... | 2026-10-15 |
| CVE-2026-67236 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, a successful POST /login caused is_authorized/2 to set an au... | 2026-10-15 |
| CVE-2026-61837 | medium | 5.3 | No | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.3.3, 4.2.9, 4.1.14, and 4.0.23, AMQP 1.0 management GET /bindings exposes f... | 2026-10-15 |
| CVE-2026-96577 | high | 7.1 | No | A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authen... | 2026-10-15 |
| CVE-2026-88842 | low | 3.3 | No | A flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages... | 2026-10-15 |
| CVE-2026-85970 | high | 7.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 enable XML external entity processing by default in mu... | 2026-10-15 |
| CVE-2026-85969 | high | 7.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an out-of-bounds write vulnerability in certai... | 2026-10-15 |
| CVE-2026-85968 | high | 7.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 contain an out-of-bounds read vulnerability in certain query-processing functionality.... | 2026-10-15 |
| CVE-2026-85967 | medium | 6.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a cross-site scripting vulnerability that coul... | 2026-10-15 |
| CVE-2026-85952 | high | 8.5 | No | Affected Linux-based Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain a server-side request for... | 2026-10-15 |
| CVE-2026-85951 | high | 8.5 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 on Azure contain a server-side request forgery vulnera... | 2026-10-15 |
| CVE-2026-65150 | high | 7.3 | No | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerab... | 2026-10-15 |
| CVE-2026-65149 | high | 7.3 | No | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnera... | 2026-10-15 |
| CVE-2026-75939 | high | 7.4 | No | A flaw was found in openshift/oc-mirror. The tool incorrectly verifies PGP (Pretty Good Privacy) release image signatures by checking for si... | 2026-10-15 |
| CVE-2026-65147 | high | 7.3 | No | NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds read. A successful exploit of this vulnerab... | 2026-10-15 |
| CVE-2026-111141 | medium | 4.7 | No | zziplib through 0.13.80 contains an out-of-bounds read vulnerability in __zzip_parse_root_directory() in zzip/zip.c that allows attackers to... | 2026-10-15 |
| CVE-2026-111123 | medium | 6.1 | No | FluidSynth through 2.6.1 contains an out-of-bounds write vulnerability that allows attackers to corrupt heap and stack memory by supplying u... | 2026-10-15 |
| CVE-2026-110874 | medium | 6.6 | No | Dolibarr before 23.0.4 contains a PHP object injection vulnerability in jsonOrUnserialize() in functions.lib.php, which calls unserialize()... | 2026-10-15 |