Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78631 | medium | 5.5 | No | The Okta Hyperdrive Agent writes the decoded SAML bearer assertion to a local application log file at the default log level on every success... | 2026-09-22 |
| CVE-2026-69762 | high | 8.8 | No | Stack-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges over a network. | 2026-09-22 |
| CVE-2026-23813 | critical | 9.8 | No | A vulnerability has been identified in the web-based management interface of AOS-CX switches that could potentially allow an unauthenticated... | 2026-09-22 |
| CVE-2026-79312 | medium | 6.8 | No | webpy web.py 0.76 is vulnerable to Session Fixation. The component Session._load() reads session_id directly from the request cookie and loa... | 2026-09-22 |
| CVE-2026-89407 | high | 7.5 | No | NumberInput.looksLikeValidNumber() in FasterXML jackson-core pre-validates "stringified numbers" with two regular expressions: PATTERN_FLOAT... | 2026-09-22 |
| CVE-2026-79315 | medium | 4.7 | No | A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-sid... | 2026-09-22 |
| CVE-2026-79079 | high | 7.8 | No | An issue in CrossWire Xiphos <= 4.3.2 allows a local attacker to execute arbitrary code via the src/main/url.cc and src/gtk/menu_popup.c com... | 2026-09-22 |
| CVE-2026-78847 | critical | 9.8 | No | An issue in gray-matter All versions (verified on 4.0.3) allows the JavaScript engine in lib/engines.js using eval() to parse front matter w... | 2026-09-22 |
| CVE-2026-88746 | high | 7.1 | No | idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php. | 2026-09-22 |
| CVE-2026-88745 | medium | 6.1 | No | EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell. | 2026-09-22 |
| CVE-2026-88411 | high | 7.5 | No | Improper error handling in the GRAPH.EFFECT component (/effects/effects_apply.c) of FalkorDB (Redis module) v4.20.1 leads to a Denial of Ser... | 2026-09-22 |
| CVE-2026-88409 | high | 8.8 | No | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a buffer overflow in the _Decode_GrB_Matrix function (/v19/decode_matri... | 2026-09-22 |
| CVE-2026-88408 | medium | 6.5 | No | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _GetGroup() function (/ops/op_aggregate.c). Thi... | 2026-09-22 |
| CVE-2026-88406 | high | 7.5 | No | FalkorDB (Redis module) v4.20.1 to v4.20.4 was discovered to contain a stack overflow in the _ValidateUnion_Clauses function (/ast/ast_valid... | 2026-09-22 |
| CVE-2026-88404 | critical | 9.8 | No | A remote code execution (RCE) vulnerability in the UniscriptExecutionService.execute() function (/services/script-execution.service.ts) of U... | 2026-09-22 |
| CVE-2026-88403 | medium | 6.5 | No | A Server-Side Request Forgery (SSRF) in the serverRequest function of nocobase v2.1.21 allows authenticated attackers to scan internal resou... | 2026-09-22 |
| CVE-2026-88402 | critical | 9.8 | No | A SQL injection vulnerability in the checkSQL function of nocobase v2.1.21 allows attackers to access sesntive database information via inje... | 2026-09-22 |
| CVE-2026-79317 | medium | 4.8 | No | A session invalidation flaw exists in x-ui 0.3.2. The full user object is stored in a client-side signed cookie, and authentication only che... | 2026-09-22 |
| CVE-2026-79316 | high | 7.6 | No | An improper access control vulnerability exists in x-ui 0.3.2. Any authenticated panel user can modify the xray configuration template throu... | 2026-09-22 |
| CVE-2026-79318 | medium | 6.5 | No | web2py 3.2.2-stable (commit a7330a2bf21219fa77860b6665de927dd4f98e6d) is vulnerable to Directory Traversal in read_file()/write_file() (appl... | 2026-09-22 |