Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84470 | medium | 6.4 | No | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) autho... | 2026-09-24 |
| CVE-2026-71462 | medium | 4.1 | No | StringListPathField.to_internal_value() calls os.path.exists() on unbounded user-supplied paths. 200 vs 400 response reveals existence of... | 2026-09-24 |
| CVE-2026-71460 | medium | 4.3 | No | /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance... | 2026-09-24 |
| CVE-2026-71458 | medium | 5.0 | No | URLModificationMiddleware resolves named-URL lookups against unfiltered Model.objects before RBAC. The 403→404 shim only rewrites 403 resp... | 2026-09-24 |
| CVE-2026-84502 | critical | 9.9 | No | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The Project scm_url field is not validated against values... | 2026-09-24 |
| CVE-2026-84486 | high | 8.2 | No | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. Four debug views that trigger the internal task, dependenc... | 2026-09-24 |
| CVE-2026-84474 | critical | 9.9 | No | A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The provisioning-callback secret (host_config_key) is expo... | 2026-09-24 |
| CVE-2026-96804 | high | 8.8 | No | MLflow's statsmodel flavor, versions 2.1.0 to 3.14.0, omits the MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False security control entirely in _load... | 2026-09-24 |
| CVE-2026-86708 | critical | 10.0 | No | ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private k... | 2026-09-24 |
| CVE-2026-86683 | high | 8.1 | No | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to change the proxy settings. | 2026-09-24 |
| CVE-2026-86678 | high | 8.8 | No | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to obtain an administrator’s API key and... | 2026-09-24 |
| CVE-2026-86677 | high | 8.8 | No | ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potenti... | 2026-09-24 |
| CVE-2026-84787 | high | 8.1 | No | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.710 and below were vulnerable to a Privilege Escalation vulnerability th... | 2026-09-24 |
| CVE-2026-76978 | high | 8.8 | No | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.709 and below were vulnerable to a Command Injection vulnerability in th... | 2026-09-24 |
| CVE-2026-75825 | high | 8.8 | No | ZohoCorp ManageEngine OpManager versions 12.8.710 and below with the Application Manager Plugin enabled were vulnerable to an Authentication... | 2026-09-24 |
| CVE-2026-19599 | critical | 9.9 | No | ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification... | 2026-09-24 |
| CVE-2026-49810 | high | 7.8 | No | Dell Command Powershell Provider (DCPP), versions prior to 2.10.2 contain an Insertion of Sensitive Information into Log File vulnerability.... | 2026-09-24 |
| CVE-2026-14913 | high | 8.8 | No | ZohoCorp ManageEngine OpManager and Firewall Analyzer versions 12.8.669 and below were vulnerable to an SQL Injection vulnerability in Rule... | 2026-09-24 |
| CVE-2026-17472 | critical | 9.6 | No | IBM Concert 1.0.0 through 3.0.0 could allow a remote authenticated attacker to access or modify unauthorized resources due to the use of wil... | 2026-09-24 |
| CVE-2026-57168 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-56120. Reason: This candidate is a duplicate of CVE-202... | 2026-09-23 |