Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75698 | critical | 9.3 | No | Adobe Connect is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject ma... | 2026-09-25 |
| CVE-2026-76708 | critical | 9.8 | No | A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-co... | 2026-09-25 |
| CVE-2026-77252 | medium | 6.5 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, caller-supplied projec... | 2026-09-25 |
| CVE-2026-77261 | high | 8.5 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, _make_ssrf_safe_hook i... | 2026-09-25 |
| CVE-2026-97636 | medium | 6.5 | No | Apache Airflow HashiCorp provider: the HashiCorp Vault secrets backend's team-scope guard can be bypassed with a user-controlled key. In a m... | 2026-09-25 |
| CVE-2026-96812 | not reported | — | No | Improper Exposure of Resource to Wrong Sphere in the host file helper (gofer) in Google gVisor prior to commit 573a9e73cf844f on Linux platf... | 2026-09-25 |
| CVE-2026-97230 | critical | 9.8 | No | IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL. The generate_ce... | 2026-09-25 |
| CVE-2026-95699 | critical | 9.6 | No | Prior to 9/18/2026, the iSteamX mobile application's AWS policy could grant authenticated users access to wildcard MQTT topics, which can ex... | 2026-09-25 |
| CVE-2026-88956 | medium | 6.8 | No | The Botslab G980H dash camera firmware contains an authentication vulnerability in the root account exposed through the device's UART interf... | 2026-09-25 |
| CVE-2026-88761 | medium | 5.3 | No | The Botslab G980H dash camera firmware generates the default WiFi password using predictable device information, portions of which are adver... | 2026-09-25 |
| CVE-2026-87722 | not reported | — | No | Uncontrolled Resource Consumption (CWE-400 / CWE-1333) in regex search query predicates (such as RegexProjectPredicate, RegexRefPredicate, R... | 2026-09-25 |
| CVE-2026-87721 | not reported | — | No | Uncontrolled Resource Consumption (CWE-400 / CWE-407) in the ANTLR 3 search query parser (QueryParser / Query.g) in Gerrit Code Review versi... | 2026-09-25 |
| CVE-2026-88386 | medium | 5.5 | No | libsndfile 1.2.2 contains a misaligned memory access issue in psf_binheader_readf() while parsing WAV fmt chunks. A specially crafted WAV fi... | 2026-09-25 |
| CVE-2026-88362 | high | 7.5 | No | MuJS e892c9fdb contains an incorrect numeric conversion vulnerability in jsR_isindex() in jsrun.c. A specially crafted JavaScript input cont... | 2026-09-25 |
| CVE-2026-88359 | medium | 6.5 | No | libfyaml 0.9.6 contains a stack exhaustion vulnerability in fy_atom_iter_format(). When processing a specially crafted YAML document contain... | 2026-09-25 |
| CVE-2026-87720 | not reported | — | No | Incorrect Authorization (CWE-863) in project name normalization (ProjectUtil.stripGitSuffix) and ProjectCache eviction logic (ProjectCacheIm... | 2026-09-25 |
| CVE-2026-85491 | high | 8.8 | No | Catalyst::Seal versions before 0.03 for Perl allow one request to disable a path or route a later one past an authorization check via a disp... | 2026-09-25 |
| CVE-2026-87118 | medium | 5.7 | No | The Botslab G980H dash camera firmware contains an out of bounds write vulnerability in its command processing functionality. An authenticat... | 2026-09-25 |
| CVE-2026-85496 | high | 8.8 | No | The Botslab G980H dash camera firmware generates session identifiers using a small sequential value space rather than a suitably unpredictab... | 2026-09-25 |
| CVE-2026-85082 | not reported | — | No | Root Browser Classic 3.3.0 passes the path of a selected SQLite database to an operating-system shell without safely separating the filename... | 2026-09-25 |