Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13016 | not reported | — | No | ServiceNow has remediated a SQL injection vulnerability that was identified in the ServiceNow AI Platform. This vulnerability could enable a... | 2026-09-24 |
| CVE-2026-94281 | medium | 6.5 | No | An out-of-bounds read in libXi's XListInputDevices() class parsing in libXi before 1.8.4 could be used by malicious X servers to crash an at... | 2026-09-24 |
| CVE-2026-93545 | medium | 6.5 | No | An out-of-bounds read in libXi's XListInputDevices() in libXi before 1.8.4 could be used by malicious X servers to crash an attached X clien... | 2026-09-24 |
| CVE-2026-93544 | medium | 6.5 | No | An out-of-bounds read in libXi's XI2 XIQueryDevice reply parsing in libXi before 1.8.4 can be used by a malicious X server to crash an attac... | 2026-09-24 |
| CVE-2026-93543 | high | 7.4 | No | An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client. | 2026-09-24 |
| CVE-2026-93542 | medium | 6.5 | No | An out-of-bounds read in libXi's XI2 class parsing via size_classes() and copy_classes() in libXi before 1.8.4 could be used by malicous ser... | 2026-09-24 |
| CVE-2026-88382 | high | 7.5 | No | hiredis commit 29ea279 (post-v1.5.0) contains an uncontrolled memory allocation vulnerability in its RESP aggregate parser. | 2026-09-24 |
| CVE-2026-96744 | high | 7.1 | No | Improper neutralization of special elements in data query logic in the cache lock implementation of the MongoDB integration for Laravel can... | 2026-09-24 |
| CVE-2026-93541 | medium | 6.5 | No | An out-of-bounds read in libXi's XQueryDeviceState() in libXi before 1.8.4 could be used by a | 2026-09-24 |
| CVE-2026-95521 | high | 7.8 | No | A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro con... | 2026-09-24 |
| CVE-2026-77798 | medium | 6.5 | No | Velociraptor contains a deadlock condition that may be triggered by authenticated users. The issue stems from a lock management bug in the u... | 2026-09-24 |
| CVE-2026-77797 | low | 3.6 | No | Velociraptor's prefetch library contains an out of bound vulnerability which may cause a crash when parsing certain malformed prefetch files... | 2026-09-24 |
| CVE-2026-97311 | medium | 4.3 | No | A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associ... | 2026-09-24 |
| CVE-2026-97177 | medium | 6.6 | No | A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fa... | 2026-09-24 |
| CVE-2026-84712 | medium | 5.3 | No | A flaw was found in the automation-controller API. The unauthenticated health-check endpoint /api/v2/ping/ (ApiV2PingView, AllowAny) over-... | 2026-09-24 |
| CVE-2026-96808 | high | 7.4 | No | In Flatpak before 1.18.1, the revokefs writer, used by the flatpak-system-helper to receive repository data from unprivileged callers, valid... | 2026-09-24 |
| CVE-2026-96269 | not reported | — | No | GNU Emacs 28.1 through 31.1 allows arbitrary code execution upon opening a file, because an untrusted value of read-symbol-shorthands affect... | 2026-09-24 |
| CVE-2026-28325 | high | 8.8 | No | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability stemming from deseri... | 2026-09-24 |
| CVE-2026-28324 | critical | 9.8 | No | SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insuffici... | 2026-09-24 |
| CVE-2026-92782 | high | 8.1 | No | Chroma through 1.5.9 fails to validate tenant and database segments when resolving collections, allowing authenticated attackers to access c... | 2026-09-24 |