Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12910 | medium | 5.4 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.6 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th... | 2026-09-28 |
| CVE-2026-13210 | high | 7.7 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.7 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 th... | 2026-09-28 |
| CVE-2026-82837 | medium | 4.3 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2... | 2026-09-28 |
| CVE-2026-19304 | high | 7.7 | No | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to obtain sensitive information from internal services due... | 2026-09-28 |
| CVE-2026-100902 | medium | 6.5 | No | A vulnerability was determined in Barco ClickShare CX-20 Gen2 up to 02.26.00.0007. Affected by this issue is some unknown functionality of t... | 2026-09-28 |
| CVE-2026-100671 | high | 8.0 | No | Grav is a flat-file CMS. In versions 2.0.19 through 2.0.24 — and in 2.0.0 through 2.0.18 and 1.7.x only where content Twig has been explicit... | 2026-09-28 |
| CVE-2026-100667 | medium | 5.3 | No | grav-plugin-login (the Grav CMS Login plugin) versions >= 3.8.7 and < 3.9.7 allow the two-factor authentication challenge to be bypassed for... | 2026-09-28 |
| CVE-2026-100663 | high | 7.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.2.Final through 4.2.17.Final does not special-case HTTP/1 CONNECT authority-form... | 2026-09-28 |
| CVE-2026-100659 | medium | 6.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) in versions 4.2.0.Final through 4.2.17.Final does not enforce the RFC 9114 requirement tha... | 2026-09-28 |
| CVE-2026-100643 | high | 8.0 | No | SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attacke... | 2026-09-28 |
| CVE-2026-100639 | high | 8.8 | No | SiYuan v3.8.3 fails to HTML-escape the data-subtype attribute when generating gutter-button markup (app/src/protyle/gutter/button.ts, assign... | 2026-09-28 |
| CVE-2026-100610 | high | 7.5 | No | Flowise through 3.1.4 exposes GET /api/v1/upsert-history/:id and PATCH /api/v1/upsert-history without route-level permission checks, and the... | 2026-09-28 |
| CVE-2026-100606 | high | 7.7 | No | Flowise through 3.1.4 (Enterprise/platform mode with SSO enabled) contains an authentication bypass in the SSO login path. When an SSO callb... | 2026-09-28 |
| CVE-2026-69498 | high | 7.0 | No | Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. | 2026-09-28 |
| CVE-2026-87719 | critical | 9.9 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 18.3 before 18.11.12, 19.0 before 19.0.9, 19.1 before 19.1.8, 19.2 b... | 2026-09-28 |
| CVE-2026-88765 | high | 8.5 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 12.3 to 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 under cer... | 2026-09-28 |
| CVE-2026-86341 | medium | 4.4 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 17.1 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that,... | 2026-09-28 |
| CVE-2026-92470 | high | 7.7 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that... | 2026-09-28 |
| CVE-2026-92529 | medium | 4.3 | No | GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that... | 2026-09-28 |
| CVE-2026-92530 | medium | 4.3 | No | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 th... | 2026-09-28 |