Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-56344 | medium | 5.9 | No | IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information,... | 2026-09-28 |
| CVE-2024-38639 | medium | 4.8 | No | An improper authentication vulnerability has been reported to affect product. The remote attackers can then exploit the vulnerability to com... | 2026-09-28 |
| CVE-2024-27123 | not reported | — | No | A cross-site scripting (XSS) vulnerability has been reported to affect QcalAgent. The local attackers can then exploit the vulnerability to... | 2026-09-28 |
| CVE-2024-58385 | critical | 9.8 | No | Yonyou U8 CRM contains an unauthenticated SQL injection vulnerability in the fillbacksettingedit.php configuration endpoint where the DontCh... | 2026-09-28 |
| CVE-2024-58384 | medium | 5.4 | No | Tornado before 6.4.1 contains a CRLF injection vulnerability in CurlAsyncHTTPClient that fails to reject carriage return and line feed chara... | 2026-09-28 |
| CVE-2024-14029 | high | 7.5 | No | Tornado before 6.4.1 ignores duplicate Transfer-Encoding: chunked headers, treating requests as having no message body and parsing the chunk... | 2026-09-28 |
| CVE-2024-23176 | medium | 5.4 | No | An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key m... | 2026-09-28 |
| CVE-2024-53922 | medium | 5.7 | No | An issue was discovered in the buffer queue driver in Samsung Automotive Processor Exynos Auto 8890, V7, V9, and V920. Lack of a length chec... | 2026-09-28 |
| CVE-2026-76717 | medium | 5.3 | No | A vulnerability exists in the Analytics and Location Engine (ALE) API that may allow for the disclosure of sensitive information. An unauthe... | 2026-09-28 |
| CVE-2026-76716 | medium | 5.3 | No | Multiple vulnerabilities exist in the Analytics and Location Engine (ALE) that may allow for unauthorized access or denial of service. An un... | 2026-09-28 |
| CVE-2026-76715 | high | 7.1 | No | A vulnerability in an administrative component of Analytics and Location Engine (ALE) is vulnerable to a man-in-the-middle (MitM) attack. Su... | 2026-09-28 |
| CVE-2026-76714 | high | 7.2 | No | Vulnerabilities in the Analytics and Location Engine web interface allows remote authenticated users to run arbitrary commands on the underl... | 2026-09-28 |
| CVE-2026-69472 | high | 7.0 | No | Use after free in Windows Devices Human Interface allows an authorized attacker to elevate privileges locally. | 2026-09-28 |
| CVE-2026-76713 | high | 7.2 | No | A vulnerability exists in the maintenance restore functionality of Analytics and Location Engine (ALE). Successful exploitation of this vuln... | 2026-09-28 |
| CVE-2026-76712 | high | 7.3 | No | A vulnerability exists in the Analytics and Location Engine (ALE) that may allow for unauthorized access, information disclosure, or denial... | 2026-09-28 |
| CVE-2026-76709 | critical | 9.8 | No | A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vuln... | 2026-09-28 |
| CVE-2026-76710 | high | 7.5 | No | A vulnerability exists in the Analytics and Location Engine (ALE) management interface that may allow for the disclosure of sensitive inform... | 2026-09-28 |
| CVE-2026-76711 | high | 7.5 | No | A vulnerability exists in an Analytics and Location Engine (ALE) component where the impacted process improperly processes incoming socket c... | 2026-09-28 |
| CVE-2026-69478 | high | 7.8 | No | Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-09-28 |
| CVE-2026-76685 | high | 8.1 | No | A vulnerability exists in the proxy packet processing logic of the affected component where it improperly processes malformed or truncated i... | 2026-09-28 |