Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-71642 | medium | 4.0 | No | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den... | 2026-09-22 |
| CVE-2026-71640 | critical | 9.1 | No | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via... | 2026-09-22 |
| CVE-2026-36392 | medium | 5.4 | No | FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS). An authenticated administrator can inject arbitrary JavaScrip... | 2026-09-22 |
| CVE-2026-89094 | critical | 9.9 | No | Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/templat... | 2026-09-22 |
| CVE-2026-79592 | high | 7.5 | No | An out-of-bounds read vulnerability exists in the xls_dumpSummary() function of libxls 1.6.3 due to insufficient validation of file-controll... | 2026-09-22 |
| CVE-2026-79591 | high | 7.8 | No | A heap-buffer-overflow and use-after-free vulnerability exists in the xls_getCSS() function of libxls 1.6.3 due to insufficient validation o... | 2026-09-22 |
| CVE-2022-26962 | medium | 5.4 | No | Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announce... | 2026-09-22 |
| CVE-2026-89087 | high | 7.3 | No | The cstruct package before 6.3.0 for OCaml mishandles indexes. | 2026-09-22 |
| CVE-2026-89086 | critical | 9.1 | No | In the jose package before 0.11.0 for OCaml, library calls to validate an RSA signature only confirm that PKCS #1 decoding succeeds, and pro... | 2026-09-22 |
| CVE-2026-95818 | low | 3.6 | No | A stack-based buffer overflow in the dynamic loader (ld.so) of the GNU C Library (glibc) versions 2.14 through 2.44 allows a local attacker... | 2026-09-22 |
| CVE-2026-94571 | not reported | — | No | In OpenStack Octavia before 18.0.1, the Amphora provider driver did not reject control characters in the L7 policy redirect_url and redirect... | 2026-09-22 |
| CVE-2026-94488 | high | 8.2 | No | Telegram Desktop before 6.9.4 allows XSS in the HTML exporter. (The first fixed stable version is 7.0.1.) This occurs in button.text.toUtf8... | 2026-09-22 |
| CVE-2026-94185 | medium | 5.5 | No | nvm resolves a requested version or alias by treating it as a filename under $NVM_DIR/alias. Before 0.40.8, nvm_alias() concatenated the req... | 2026-09-22 |
| CVE-2026-93854 | not reported | — | No | In OpenStack Blazar before 17.0.1, the V2 lease API does not enforce object-level authorization on its update and delete operations (PUT /v2... | 2026-09-22 |
| CVE-2026-93852 | not reported | — | No | In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing projec... | 2026-09-22 |
| CVE-2025-56565 | high | 7.6 | No | DD-WRT firmware, as deployed on TP-Link TL-WR740N v1 through v4 hardware, stores sensitive authentication credentials in cleartext within no... | 2026-09-22 |
| CVE-2026-25827 | low | 2.3 | No | An issue was discovered in Keyfactor SignServer before 7.6.0. A number of properties were identified to not have any restrictions to what pa... | 2026-09-22 |
| CVE-2026-25826 | medium | 4.9 | No | An issue was discovered in Keyfactor SignServer before 7.6.0. The attribute ATTRIBUTESFILE in PKCS11CryptoToken can be set to a readable fil... | 2026-09-22 |
| CVE-2026-25825 | low | 2.7 | No | An issue was discovered in Keyfactor SignServer before 7.6.0. The output file to which SignerStatusReportWorker logs the report can be set t... | 2026-09-22 |
| CVE-2026-71198 | not reported | — | No | In OpenStack Glance before 32.0.1, the location API does not validate destination hosts when adding an HTTP location to an image. Unlike the... | 2026-09-22 |