Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68852 | medium | 5.5 | No | Use of uninitialized resource in Microsoft Account allows an authorized attacker to disclose information locally. | 2026-09-29 |
| CVE-2026-88025 | high | 8.3 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB C# Driver can cause a caller-supplied... | 2026-09-29 |
| CVE-2026-88775 | critical | 9.8 | No | Memory overflow vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-... | 2026-09-29 |
| CVE-2026-88774 | high | 7.2 | No | Vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-64.23, before 14... | 2026-09-29 |
| CVE-2026-88773 | critical | 10.0 | No | Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Citrix NetScaler ADC and Citrix NetScaler... | 2026-09-29 |
| CVE-2026-82379 | high | 7.7 | No | Authentication Bypass by Capture-replay in Apache Roller 6.1.5 allows an attacker who captures a valid WSSE digest authentication header to... | 2026-09-29 |
| CVE-2026-82378 | critical | 9.0 | No | Incorrect Authorization in the OAuth 1.0a authorization endpoint of Apache Roller 6.1.5 allows an unauthenticated remote attacker who learns... | 2026-09-29 |
| CVE-2026-82377 | critical | 9.9 | No | Missing Authorization in Apache Roller 6.1.5 allows an authenticated user to read, modify, or delete weblog content belonging to other weblo... | 2026-09-29 |
| CVE-2026-84990 | high | 8.8 | No | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_availa... | 2026-09-29 |
| CVE-2026-81569 | medium | 4.3 | No | An improper authorization vulnerability exists in the handling of sub-workflow tasks. An authenticated user who does not have permission to... | 2026-09-29 |
| CVE-2026-78214 | medium | 5.3 | No | An authentication bypass vulnerability exists in the protection of Actuator endpoints. The application determines whether authentication is... | 2026-09-29 |
| CVE-2026-88026 | medium | 6.5 | No | Improper neutralization of regular-expression metacharacters in the LINQ query translation component of the MongoDB C# Driver can cause a ca... | 2026-09-29 |
| CVE-2026-71898 | medium | 4.3 | No | An incorrect authorization check in Apache DolphinScheduler allows an authenticated user with only read permission for a project to modify a... | 2026-09-29 |
| CVE-2026-71897 | medium | 4.3 | No | An improper authorization check in Apache DolphinScheduler allows an authenticated user to use the batch-copy and batch-move endpoints to op... | 2026-09-29 |
| CVE-2026-61744 | medium | 6.5 | No | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, POST /api/barcode/ accepts an attacker-synthesized internal JSON ba... | 2026-09-29 |
| CVE-2026-58504 | medium | 6.1 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.5, opening or importing a crafted .drawio file ca... | 2026-09-29 |
| CVE-2026-51996 | critical | 9.8 | No | An issue in geelen mcp-remote 0.1.16 through 0.1.38 allows a remote attacker to execute arbitrary code via the src/lib/utils.ts and the getS... | 2026-09-29 |
| CVE-2026-102004 | high | 7.8 | No | Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in memory corruption within the memory management subsystem.... | 2026-09-29 |
| CVE-2026-101041 | not reported | — | No | The account recovery (password reset) functionality in the vulnerability-lookup web application contains a time-of-check-to-time-of-use (TOC... | 2026-09-29 |
| CVE-2026-88027 | high | 8.1 | No | Improper neutralization of special elements in data query logic in the embedded-document relation handling of the MongoDB integration for La... | 2026-09-29 |