Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85716 | low | 3.7 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3... | 2026-09-24 |
| CVE-2026-85719 | high | 7.5 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2... | 2026-09-24 |
| CVE-2026-82399 | high | 7.5 | No | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths... | 2026-09-24 |
| CVE-2026-75516 | not reported | — | No | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.34.0, AMQ... | 2026-09-24 |
| CVE-2026-77409 | not reported | — | No | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, Channel.dispatch in channel.go, confirms.confirm in confirms.go, and Connect... | 2026-09-24 |
| CVE-2026-77405 | not reported | — | No | RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, tlsConfigFromURI in uri.go creates tls.Config values without setting MinVers... | 2026-09-24 |
| CVE-2026-48540 | medium | 5.4 | No | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbit... | 2026-09-24 |
| CVE-2026-97323 | medium | 6.3 | No | A vulnerability was determined in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. This impacts the function getOriginalFilename of the fil... | 2026-09-24 |
| CVE-2026-97321 | medium | 6.3 | No | A vulnerability has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. The impacted element is the function GoViewDataServiceIm... | 2026-09-24 |
| CVE-2026-97232 | medium | 6.3 | No | A vulnerability was determined in volotat Anagnorisis up to 0.4.2. Affected by this vulnerability is the function get_file_content/save_file... | 2026-09-24 |
| CVE-2026-88390 | high | 7.7 | No | An out-of-bounds write vulnerability in jslGetTokenValueAsString() in Espruino 2v29 (commit bffc6d0) allows crafted JavaScript input contain... | 2026-09-24 |
| CVE-2026-88376 | high | 7.5 | No | Bento4 1.6.0.0 contains an integer underflow vulnerability in AP4_AvccAtom::Create() and AP4_HvccAtom::Create(). A specially crafted MP4 fil... | 2026-09-24 |
| CVE-2026-88368 | high | 7.5 | No | NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in the rasterizer's nsvg__addActive() function. A specially... | 2026-09-24 |
| CVE-2026-88357 | high | 7.5 | No | nDPI 5.1.0 contains a memory access issue in the DNS dissector and serializer deserialization code. Specially crafted network input can caus... | 2026-09-24 |
| CVE-2026-97362 | high | 7.5 | No | HFS2 version 2.4.0 and earlier contains a denial of service vulnerability that allows unauthenticated attackers to cause a complete and pers... | 2026-09-24 |
| CVE-2026-51995 | high | 7.5 | No | An issue in geelen mcp-remote 0.1.32 through 0.1.38 allows a remote attacker to obtain sensitive information via the src/lib/authorization-s... | 2026-09-24 |
| CVE-2026-97360 | critical | 10.0 | No | HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read... | 2026-09-24 |
| CVE-2026-97057 | high | 7.5 | No | redis-parser through 3.0.0 fails to validate the multi-bulk length value in RESP protocol parsing, allowing attackers to trigger an uncaught... | 2026-09-24 |
| CVE-2026-97056 | medium | 6.8 | No | SigNoz versions from v0.98.0 up to (but not including) v0.143.0, when configured to use the opaque session tokenizer (which was not the defa... | 2026-09-24 |
| CVE-2026-97055 | high | 8.1 | No | SigNoz from v0.8.0 before v0.143.0 defaults the JWT tokenizer signing secret (tokenizer::jwt::secret, set via SIGNOZ_TOKENIZER_JWT_SECRET or... | 2026-09-24 |