Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82294 | medium | 6.5 | No | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | 2026-09-29 |
| CVE-2026-65112 | medium | 6.5 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause uncontrolled resource consumption. A succe... | 2026-09-29 |
| CVE-2026-96651 | medium | 6.5 | No | Plex Media Server before 1.43.3.10861 builds a file path from the url parameter without checking it for ../ sequences, allowing path travers... | 2026-09-29 |
| CVE-2026-65113 | critical | 9.8 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of hard-coded credentials. A successfu... | 2026-09-29 |
| CVE-2026-65115 | medium | 6.5 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker may cause uncontrolled resource consumption. A success... | 2026-09-29 |
| CVE-2026-65117 | high | 8.8 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause use of a hard-coded password. A successful... | 2026-09-29 |
| CVE-2026-69365 | high | 8.0 | No | Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges over a network. | 2026-09-29 |
| CVE-2026-65124 | high | 8.1 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause an XML injection. A successful exploit of... | 2026-09-29 |
| CVE-2026-65125 | high | 8.8 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause external control of a file name or path. A... | 2026-09-29 |
| CVE-2026-65126 | high | 8.8 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause improper enforcement of a behavioral workf... | 2026-09-29 |
| CVE-2026-97897 | low | 3.5 | No | A security flaw has been discovered in Krayin laravel-crm up to 2.2.5. This issue affects some unknown processing of the file Sanitizer.php... | 2026-09-29 |
| CVE-2026-71483 | not reported | — | No | Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html() in... | 2026-09-29 |
| CVE-2026-55214 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.6 until 11.0.8, an authenticated technician can store active markup in su... | 2026-09-29 |
| CVE-2026-53610 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, an attacker can craft a URL for a dashboard that reflects... | 2026-09-29 |
| CVE-2026-49469 | not reported | — | No | GLPI is a free asset and IT management software package. From 0.70 until 10.0.26 and 11.0.8, an authenticated hotliner or technician can sub... | 2026-09-29 |
| CVE-2026-102634 | high | 7.5 | No | SGLang through 0.5.20 in prefill/decode disaggregation mode fails to validate duplicate bootstrap_room fields in /generate requests with Moo... | 2026-09-29 |
| CVE-2026-100537 | low | 3.1 | No | OpenClaw (npm package 'openclaw') before 2026.8.1 fails to apply the originating requester's effective tool policy during Active Memory auto... | 2026-09-29 |
| CVE-2026-100533 | medium | 5.3 | No | OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallba... | 2026-09-29 |
| CVE-2026-100529 | medium | 6.4 | No | OpenClaw versions before 2026.8.1 contain an authorization scope widening vulnerability in file-transfer allow-always approvals that allows... | 2026-09-29 |
| CVE-2026-100521 | medium | 6.1 | No | Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML... | 2026-09-29 |