Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78623 | critical | 9.9 | No | The Okta Access Gateway does not sanitize SAML assertion values before interpolating them into database queries in the advanced mode datasto... | 2026-09-22 |
| CVE-2026-95675 | critical | 9.8 | No | D-Link DAP-1360 firmware version 6.14 and earlier contains an unauthenticated remote code execution vulnerability that allows remote attacke... | 2026-09-22 |
| CVE-2026-94108 | medium | 6.5 | No | getID3 through 1.9.26 contains an XML external entity injection vulnerability in the XML2array helper function that fails to properly disabl... | 2026-09-22 |
| CVE-2026-94106 | high | 8.8 | No | getID3 before 1.9.26 contains an OS command injection vulnerability in shell-out handlers that fail to escape filenames in command strings.... | 2026-09-22 |
| CVE-2026-93991 | high | 7.7 | No | Argo Workflows versions 4.1.0 through 4.1.3 contain an authorization bypass vulnerability in ListArchivedWorkflows that fails to apply clust... | 2026-09-22 |
| CVE-2026-93987 | low | 3.4 | No | rclone versions 1.56.0 through 1.75.0 contain a path traversal vulnerability in the `rclone serve docker` volume plugin. newVolume() in cmd/... | 2026-09-22 |
| CVE-2026-93986 | low | 3.1 | No | rclone before 1.75.1 fails to confine names from server and third-party listing responses to the listed directory, allowing path traversal s... | 2026-09-22 |
| CVE-2017-20284 | high | 7.5 | No | Caucho Resin contains a path traversal vulnerability in the documentation webapp (resin-doc) that allows remote unauthenticated attackers to... | 2026-09-22 |
| CVE-2026-93752 | high | 7.5 | No | CSSOM through 0.5.0 contains a denial of service vulnerability in CSSStyleDeclaration.setProperty() that fails to validate reserved property... | 2026-09-22 |
| CVE-2026-93751 | medium | 6.5 | No | uri-js through 4.4.1 contains an improper UTF-8 decoding vulnerability in pctDecChars() that decodes invalid and overlong percent-encoded se... | 2026-09-22 |
| CVE-2026-93749 | high | 7.5 | No | source-map-js through 1.2.1 fails to validate the per-section offset line value in indexed source maps, allowing attackers to specify arbitr... | 2026-09-22 |
| CVE-2026-93690 | high | 7.5 | No | uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment... | 2026-09-22 |
| CVE-2026-93689 | medium | 5.5 | No | WinFsp through 2.2.26215 contains a null pointer dereference vulnerability in the kernel driver's Fast I/O device control handler that fails... | 2026-09-22 |
| CVE-2026-7006 | high | 7.3 | No | Sublime Text for Windows through Build 4192 (Sublime Text 4) and Build 3207 (Sublime Text 3) contains a local privilege escalation vulnerabi... | 2026-09-22 |
| CVE-2026-93658 | high | 7.0 | No | uutils coreutils versions before 0.10.0 apply setuid or setgid mode to install destinations before finalizing ownership changes, allowing pr... | 2026-09-22 |
| CVE-2026-93602 | medium | 4.4 | No | rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distribu... | 2026-09-22 |
| CVE-2026-93601 | low | 2.2 | No | rustls-webpki (the Rust webpki fork used by rustls) versions >= 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permi... | 2026-09-22 |
| CVE-2026-93600 | low | 2.2 | No | rustls-webpki (rustls/webpki) versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constrai... | 2026-09-22 |
| CVE-2026-93599 | high | 7.5 | No | rustls-webpki through 0.103.12 (and 0.104.0-alpha releases before 0.104.0-alpha.7) contains a reachable panic in bit_string_flags() in src/d... | 2026-09-22 |
| CVE-2026-93450 | high | 7.5 | No | go-openapi/swag jsonutils before 0.27.1 contains a stack overflow vulnerability in ordered JSON parsing and serialization due to unbounded r... | 2026-09-22 |