Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83311 | high | 8.5 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-27 |
| CVE-2026-97404 | not reported | — | No | In OpenStack Zaqar before 22.0.2, WSGI transport mishandles the URL-Signature header. By sending a request with an empty URL-Signature heade... | 2026-09-26 |
| CVE-2026-97176 | medium | 4.2 | No | A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occ... | 2026-09-26 |
| CVE-2026-97155 | medium | 6.5 | No | Fabasoft Folio Client before 2026, a locally installed component that communicates with the Fabasoft browser extension via web messaging, do... | 2026-09-26 |
| CVE-2026-96807 | medium | 4.0 | No | In Flatpak before 1.18.1, a malicious sandboxed app can replace ~/.var/app/$appid/.ld.so with a symlink, causing regenerate_ld_cache to writ... | 2026-09-26 |
| CVE-2026-96448 | medium | 6.6 | No | A flaw was found in the Fine-Grained Admin Permissions (FGAP v2) feature of Keycloak, an identity and access management solution. The issue... | 2026-09-26 |
| CVE-2026-96446 | medium | 4.2 | No | A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path pr... | 2026-09-26 |
| CVE-2026-93399 | critical | 9.1 | No | The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'bookly_get... | 2026-09-26 |
| CVE-2026-92680 | medium | 5.5 | No | Araxis Merge for Windows version 2011.4074 through 2026.0 stores user-configured credentials for remote servers in the Windows registry and... | 2026-09-26 |
| CVE-2026-92289 | critical | 9.1 | No | Lemonldap::NG::Portal versions from 2.23.0 before 2.23.4 for Perl allow a PKCE bypass for public Relying Parties in "PKCE or secret" mode be... | 2026-09-26 |
| CVE-2026-84724 | medium | 6.6 | No | An argument-injection flaw was found in the Ansible Automation Platform automation-controller system-job subsystem. The system-job template... | 2026-09-26 |
| CVE-2026-88840 | medium | 5.3 | No | BusyBox TLS get_client_hello() reads past the end of the input buffer when parsing a truncated ClientHello message. | 2026-09-26 |
| CVE-2026-89276 | critical | 9.9 | No | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in... | 2026-09-26 |
| CVE-2026-84717 | medium | 5.3 | No | A flaw was found in the Ansible Automation Platform automation-controller. The unauthenticated Bitbucket Data Center webhook receiver skips... | 2026-09-26 |
| CVE-2026-84706 | high | 7.6 | No | A flaw was found in Ansible Automation Platform's automation-controller. The custom Credential Type environment-variable injector validates... | 2026-09-26 |
| CVE-2026-84499 | high | 7.7 | No | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Survey questions of type password are write-only and store... | 2026-09-26 |
| CVE-2026-83964 | high | 7.5 | No | Adobe Connect is affected by an Improper Certificate Validation vulnerability that could lead to disclosure of sensitive memory. An attacker... | 2026-09-26 |
| CVE-2026-82013 | critical | 9.9 | No | Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalation. A... | 2026-09-26 |
| CVE-2026-82003 | high | 8.5 | No | Adobe Campaign Classic (ACC) is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the... | 2026-09-26 |
| CVE-2026-75684 | critical | 9.3 | No | Adobe Connect is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scrip... | 2026-09-26 |