Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93783 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcomm_recv_frame rfcomm_rec... | 2026-10-03 |
| CVE-2026-93782 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates gu... | 2026-10-03 |
| CVE-2026-93781 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsi_eh_lock_door() scsi... | 2026-10-03 |
| CVE-2026-93288 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pern... | 2026-10-03 |
| CVE-2026-93287 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: i2c: smbus: reject oversized block transfers in the common path The SM... | 2026-10-03 |
| CVE-2026-93286 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: net: appletalk: fix NULL pointer dereference in aarp_send_ddp() aarp_s... | 2026-10-03 |
| CVE-2026-19445 | not reported | — | No | A remote, unauthenticated TLS client can make a server crash or call through a freed pointer if its sni_callback assigns a different context... | 2026-10-03 |
| CVE-2026-76504 | critical | 9.8 | Listed | A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote a... | 2026-10-03 |
| CVE-2026-90451 | medium | 5.9 | No | An example environment-configuration file ships with a fixed, publicly-known secret value used to sign authentication cookies for a bundled... | 2026-10-02 |
| CVE-2026-90450 | medium | 4.3 | No | The application's role-authorization lookup defaults to granting access when a request handler's name is not present in its table of role re... | 2026-10-02 |
| CVE-2026-90449 | medium | 6.5 | No | When a particular authentication mode is configured, the reverse proxy forwards requests for a bundled third-party administrative interface... | 2026-10-02 |
| CVE-2026-90448 | medium | 6.5 | No | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restr... | 2026-10-02 |
| CVE-2026-90447 | medium | 6.5 | No | A routing rule selects between two different authentication mechanisms for the same downstream service based on the value of a client-suppli... | 2026-10-02 |
| CVE-2026-90446 | medium | 4.3 | No | An application programming interface endpoint accepts a user-supplied value and interpolates it directly into the path of a backend request... | 2026-10-02 |
| CVE-2026-104887 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78409. Reason: This candidate is a duplicate of CVE-202... | 2026-10-02 |
| CVE-2026-104886 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78410. Reason: This candidate is a duplicate of CVE-202... | 2026-10-02 |
| CVE-2026-90445 | medium | 6.5 | No | An interface that accepts file uploads from authenticated users extracts the contents of uploaded archives without validating that extracted... | 2026-10-02 |
| CVE-2026-90444 | high | 8.8 | No | A file-transfer interface that requires valid credentials accepts attacker-controlled filenames without restricting shell metacharacters. An... | 2026-10-02 |
| CVE-2026-90443 | medium | 5.4 | No | A web interface reflects a portion of the request URL into a script context and a hyperlink attribute without adequate encoding, and does no... | 2026-10-02 |
| CVE-2026-103552 | high | 7.3 | No | Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows t... | 2026-10-02 |