Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88028 | medium | 6.5 | No | Improper neutralization of special elements in data query logic in the polymorphic relation handling of the MongoDB integration for Laravel... | 2026-09-29 |
| CVE-2026-68881 | medium | 5.5 | No | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | 2026-09-29 |
| CVE-2026-88029 | high | 8.3 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Python Driver can cause a caller-supp... | 2026-09-29 |
| CVE-2026-68885 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-29 |
| CVE-2026-88030 | high | 8.3 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Ruby Driver can cause a caller-suppli... | 2026-09-29 |
| CVE-2026-88031 | high | 8.1 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Go Driver can cause a caller-supplied... | 2026-09-29 |
| CVE-2026-68888 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-29 |
| CVE-2026-68895 | medium | 5.5 | No | Numeric truncation error in Internet Storage Name Service allows an authorized attacker to disclose information locally. | 2026-09-29 |
| CVE-2026-69375 | medium | 6.5 | No | Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a netw... | 2026-09-29 |
| CVE-2026-69378 | high | 7.5 | No | Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network. | 2026-09-29 |
| CVE-2022-25863 | critical | 9.8 | No | The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing i... | 2026-09-29 |
| CVE-2026-65130 | critical | 9.8 | No | NVIDIA Infrastructure Controller for Linux contains a vulnerability where an attacker could cause OS command injection. A successful exploit... | 2026-09-29 |
| CVE-2026-65178 | high | 7.8 | No | NVIDIA NeMo contains a vulnerability in its dataset-loading workflow where a maliciously crafted model_config.yaml can inject unsafe paramet... | 2026-09-29 |
| CVE-2026-65179 | high | 8.8 | No | NVIDIA NeMo contains a vulnerability in the TabularTokenizer class where it deserializes an untrusted, attacker-controlled .pkl file via pic... | 2026-09-29 |
| CVE-2026-77242 | high | 7.5 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, validate_url_for_ssrf... | 2026-09-29 |
| CVE-2026-77243 | high | 8.8 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOL... | 2026-09-29 |
| CVE-2026-77244 | critical | 10.0 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport acc... | 2026-09-29 |
| CVE-2026-82387 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with media-upload... | 2026-09-29 |
| CVE-2026-82386 | high | 7.7 | No | Improper Restriction of XML External Entity Reference in Apache Roller 6.1.5 allows a weblog administrator to read files readable by the Rol... | 2026-09-29 |
| CVE-2026-82385 | medium | 6.5 | No | Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 6.1.5 allows a weblog administrator to read files on the applica... | 2026-09-29 |