Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-28666 | high | 8.8 | No | In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check... | 2026-09-23 |
| CVE-2026-28668 | high | 7.8 | No | In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalatio... | 2026-09-23 |
| CVE-2026-28671 | low | 3.3 | No | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local info... | 2026-09-23 |
| CVE-2026-45531 | high | 7.8 | No | In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of... | 2026-09-23 |
| CVE-2026-49879 | high | 8.8 | No | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execu... | 2026-09-23 |
| CVE-2026-49881 | high | 7.8 | No | In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could le... | 2026-09-23 |
| CVE-2026-49882 | high | 8.8 | No | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code... | 2026-09-23 |
| CVE-2026-49884 | high | 7.8 | No | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es... | 2026-09-23 |
| CVE-2026-96758 | critical | 9.8 | No | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property... | 2026-09-23 |
| CVE-2026-96513 | high | 7.3 | No | A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php... | 2026-09-23 |
| CVE-2026-93970 | high | 7.3 | No | A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/s... | 2026-09-23 |
| CVE-2026-93368 | high | 7.5 | No | The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter i... | 2026-09-23 |
| CVE-2026-93337 | high | 7.8 | No | NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN co... | 2026-09-23 |
| CVE-2026-92764 | medium | 4.3 | No | OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning th... | 2026-09-23 |
| CVE-2026-91092 | medium | 4.3 | No | The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the... | 2026-09-23 |
| CVE-2026-87022 | high | 7.5 | No | Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-defla... | 2026-09-23 |
| CVE-2026-89412 | high | 7.2 | No | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-09-23 |
| CVE-2026-79677 | high | 7.5 | No | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of servi... | 2026-09-23 |
| CVE-2026-78437 | high | 7.3 | No | Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anoth... | 2026-09-23 |
| CVE-2026-78383 | high | 7.5 | No | Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP proc... | 2026-09-23 |