Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93710 | high | 7.5 | No | Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response i... | 2026-09-22 |
| CVE-2026-93012 | critical | 9.8 | No | Email::Sender::Transport::Sendmail versions before 2.602 for Perl allow arbitrary command execution on Windows sending a message whose envel... | 2026-09-22 |
| CVE-2026-77558 | high | 7.5 | No | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe... | 2026-09-22 |
| CVE-2026-77556 | high | 7.5 | No | A malicious actor with access to the network could exploit an Out-of-bounds Read vulnerability found in certain UniFi gateway devices to exe... | 2026-09-22 |
| CVE-2026-77555 | high | 7.5 | No | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex... | 2026-09-22 |
| CVE-2026-77544 | high | 7.5 | No | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex... | 2026-09-22 |
| CVE-2026-79313 | critical | 9.8 | No | webpy web.py 0.76 is vulnerable to Insufficient Session Expiration. The application's session management relies on periodic cleanup to expir... | 2026-09-22 |
| CVE-2026-76192 | medium | 5.5 | No | InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker... | 2026-09-22 |
| CVE-2026-75744 | high | 8.1 | No | Adobe Experience Manager Forms JEE is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privilege... | 2026-09-22 |
| CVE-2026-70410 | high | 8.8 | No | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite Avatica. Plugin instantia... | 2026-09-22 |
| CVE-2026-78625 | medium | 6.7 | No | The Okta Access Gateway does not sanitize dashboard label values before writing them into generated PHP configuration files. The generated f... | 2026-09-22 |
| CVE-2026-78626 | medium | 6.5 | No | The Okta Access Gateway improperly handles input sanitization and regular expression evaluation within its Protected Rule authorization chec... | 2026-09-22 |
| CVE-2026-78627 | medium | 5.5 | No | The Okta Hyperdrive Integration installer does not mask the OAuth client secret when passed as an MSI property. The credential is recorded i... | 2026-09-22 |
| CVE-2026-69725 | high | 7.8 | No | Double free in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-78629 | medium | 5.5 | No | The Okta Hyperdrive agent plugin returns a success response without a signed SAML assertion when the organization's policy requires no MFA f... | 2026-09-22 |
| CVE-2026-69729 | high | 8.8 | No | Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to execute code over a network. | 2026-09-22 |
| CVE-2026-69735 | high | 7.0 | No | Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-69740 | high | 8.8 | No | Use after free in Windows Hello allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-69757 | high | 7.5 | No | Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network. | 2026-09-22 |
| CVE-2026-78630 | medium | 6.7 | No | The Okta Access Gateway does not neutralize shell metacharacters in SNMP configuration values before a privileged script uses them to constr... | 2026-09-22 |