Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73956 | critical | 9.8 | No | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected... | 2026-09-22 |
| CVE-2026-73957 | critical | 9.3 | No | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services). Supported versions that are... | 2026-09-22 |
| CVE-2026-73965 | medium | 6.8 | No | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Cloud Gateway). Supported versions that are affected are... | 2026-09-22 |
| CVE-2026-83004 | high | 7.2 | No | Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle). Supported versions... | 2026-09-22 |
| CVE-2026-69790 | high | 7.8 | No | Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-69791 | high | 7.0 | No | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-69792 | medium | 4.7 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker... | 2026-09-22 |
| CVE-2026-87141 | high | 7.7 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-69794 | medium | 5.5 | No | Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally. | 2026-09-22 |
| CVE-2026-90817 | critical | 9.8 | No | An unauthenticated Remote Code Execution vulnerability was found in the survey passthrough routing and Data Import processing logic, in whic... | 2026-09-22 |
| CVE-2026-88738 | high | 8.8 | No | Jazzware RT1000 Edge webUI v. 20.0.1 contains an unrestricted file upload vulnerability in the upgrade package upload functionality. An atta... | 2026-09-22 |
| CVE-2026-88623 | high | 7.5 | No | NUUO Network Video Recorder 2.0.0 is vulnerable to arbitrary file read. In up.php, the url parameter submitted by the user via POST is recei... | 2026-09-22 |
| CVE-2026-87137 | high | 7.6 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-87136 | high | 7.5 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-93556 | not reported | — | No | The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed.... | 2026-09-22 |
| CVE-2026-92438 | high | 8.8 | No | The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in... | 2026-09-22 |
| CVE-2026-91827 | high | 7.5 | No | The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator late... | 2026-09-22 |
| CVE-2026-88788 | medium | 6.8 | No | The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a fro... | 2026-09-22 |
| CVE-2026-85219 | low | 3.7 | No | Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory... | 2026-09-22 |
| CVE-2026-85220 | low | 3.7 | No | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack... | 2026-09-22 |