Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85717 | medium | 6.8 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2... | 2026-09-30 |
| CVE-2026-81868 | medium | 6.5 | No | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0,... | 2026-09-30 |
| CVE-2026-81516 | high | 7.5 | No | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. From 4.0.0 unti... | 2026-09-30 |
| CVE-2026-85078 | medium | 6.5 | No | Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume t... | 2026-09-30 |
| CVE-2026-81871 | not reported | — | No | OpenTelemetry-Go is the Go implementation of OpenTelemetry. Prior to version 0.21.0, the exporters/otlp/otlplog/otlploggrpc package loads OT... | 2026-09-30 |
| CVE-2026-89102 | medium | 6.5 | No | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can l... | 2026-09-30 |
| CVE-2026-13720 | medium | 5.4 | No | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when... | 2026-09-30 |
| CVE-2026-13719 | medium | 4.3 | No | An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When th... | 2026-09-30 |
| CVE-2026-81842 | medium | 4.3 | No | An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission,... | 2026-09-30 |
| CVE-2026-81841 | medium | 5.3 | No | Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the... | 2026-09-30 |
| CVE-2026-102875 | high | 7.8 | No | VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt... | 2026-09-30 |
| CVE-2026-102809 | medium | 6.5 | No | PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the wr... | 2026-09-30 |
| CVE-2026-102567 | medium | 6.1 | No | CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields witho... | 2026-09-30 |
| CVE-2026-102566 | high | 7.8 | No | CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allo... | 2026-09-30 |
| CVE-2026-4034 | not reported | — | No | Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through... | 2026-09-30 |
| CVE-2026-101878 | high | 7.5 | No | Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored proced... | 2026-09-30 |
| CVE-2026-102297 | medium | 4.3 | No | ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Eve... | 2026-09-30 |
| CVE-2026-102296 | medium | 6.5 | No | ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP camera... | 2026-09-30 |
| CVE-2024-58386 | medium | 6.5 | No | ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read ar... | 2026-09-30 |
| CVE-2026-93355 | high | 8.1 | No | LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au... | 2026-09-30 |