Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96764 | medium | 4.3 | No | A weakness has been identified in kvcache-ai mooncake up to 0.3.12/0.3.14-rc1. Impacted is the function MasterService::GetReplicaListByRegex... | 2026-09-24 |
| CVE-2026-96551 | medium | 4.3 | No | A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the... | 2026-09-24 |
| CVE-2026-86867 | medium | 6.5 | No | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect... | 2026-09-24 |
| CVE-2026-85682 | high | 8.8 | No | The YOP Poll plugin for WordPress is vulnerable to Origin Validation Error in all versions up to, and including, 7.0.10. This is due to the... | 2026-09-24 |
| CVE-2026-84720 | medium | 6.5 | No | A flaw was found in the Ansible Automation Platform automation-controller. The WorkflowJobNode.ancestor_artifacts database column, which sto... | 2026-09-24 |
| CVE-2026-84718 | medium | 4.3 | No | A flaw was found in the Ansible Automation Platform automation-controller. In the shipped production configuration, the Controller trusts th... | 2026-09-24 |
| CVE-2026-84714 | high | 7.1 | No | A flaw was found in the automation-controller input-validation guard sanitize_jinja(). The function uses two regular expressions to reject... | 2026-09-24 |
| CVE-2026-81645 | medium | 5.9 | No | Out-of-bounds read vulnerability in the graphics module. Successful exploitation of this vulnerability may affect availability. | 2026-09-24 |
| CVE-2026-63628 | not reported | — | No | mppx is a TypeScript interface for machine payments protocol. Prior to 0.8.2, the fee-payer cosigning path in src/tempo/internal/fee-payer.t... | 2026-09-24 |
| CVE-2026-59167 | critical | 10.0 | No | SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/li... | 2026-09-24 |
| CVE-2026-56736 | high | 8.2 | No | phpMyFAQ is an open source FAQ web application. A stored cross-site scripting (XSS) vulnerability in versions prior to 4.2.0-alpha allows an... | 2026-09-24 |
| CVE-2026-3253 | medium | 4.3 | No | The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability... | 2026-09-24 |
| CVE-2026-69322 | high | 8.0 | No | Double free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network. | 2026-09-24 |
| CVE-2026-69328 | high | 7.8 | No | Untrusted search path in Windows Storage allows an authorized attacker to elevate privileges locally. | 2026-09-24 |
| CVE-2026-44236 | high | 7.1 | No | rabbitmq-c is a C-language AMQP client library for RabbitMQ. Prior to 0.16.0, a malicious AMQP server can send an undersized connection.tune... | 2026-09-24 |
| CVE-2026-96826 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Shazzad Hossain Khan W4 Post List allo... | 2026-09-24 |
| CVE-2026-92905 | medium | 5.3 | No | ZohoCorp ManageEngine EventLog Analyzer and Log360 before build 13071 were vulnerable to a DoS vulnerability that allowed attackers to crash... | 2026-09-24 |
| CVE-2026-84691 | high | 8.7 | No | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The setting that formats the log message emitted for API 4... | 2026-09-24 |
| CVE-2026-96545 | medium | 4.4 | No | An out-of-bounds heap read flaw was found in GIMP's TIM image loader. When a user opens a crafted 4bpp TIM image that causes promotion to an... | 2026-09-24 |
| CVE-2026-71465 | low | 3.1 | No | RunAdHocCommand.build_args() appends limit as bare positional (args.append(limit)) instead of using args.extend(['-l', limit]) like RunJob... | 2026-09-24 |