Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-18458 | not reported | — | No | Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerab... | 2026-09-22 |
| CVE-2026-18457 | not reported | — | No | Heap-based Buffer Overflow vulnerability in RTI Connext Professional (Core Libraries) allows Overflow Buffers. This issue affects Connext Pr... | 2026-09-22 |
| CVE-2026-11389 | not reported | — | No | Out-of-bounds Read, Function Call With Incorrect Number of Arguments, Access of Resource Using Incompatible Type ('Type Confusion') vulnerab... | 2026-09-22 |
| CVE-2026-11388 | not reported | — | No | Double Free vulnerability in RTI Connext Professional (Core Libraries) allows File Manipulation. This issue affects Connext Professional: fr... | 2026-09-22 |
| CVE-2026-94456 | critical | 9.1 | No | Postiz generates security-sensitive credentials using `Math.random()` instead of a cryptographically secure source. The same helper is used... | 2026-09-22 |
| CVE-2026-94455 | high | 7.1 | No | An HTTP endpoint intended for provisioning enterprise and reseller organisations is reachable without any session. The authentication middle... | 2026-09-22 |
| CVE-2026-95508 | high | 7.4 | No | A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interf... | 2026-09-22 |
| CVE-2026-95503 | medium | 6.8 | No | A flaw was found in the Kerberos federation provider of Keycloak, an open-source identity and access management solution. When Kerberos pass... | 2026-09-22 |
| CVE-2026-76974 | medium | 5.3 | No | SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link t... | 2026-09-22 |
| CVE-2026-92382 | medium | 4.1 | No | An out-of-bounds write flaw was found in usbredir. Starting an isochronous OUT stream with a transfer count of 1 leaves the stream's single... | 2026-09-22 |
| CVE-2026-94368 | high | 7.1 | No | A flaw was found in the signature verification logic of noobaa-core, the core component of the NooBaa Multicloud Object Gateway. The issue o... | 2026-09-22 |
| CVE-2026-94218 | low | 3.1 | No | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an... | 2026-09-22 |
| CVE-2026-94215 | medium | 5.5 | No | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API... | 2026-09-22 |
| CVE-2026-94213 | medium | 4.9 | No | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occu... | 2026-09-22 |
| CVE-2026-94001 | medium | 6.5 | No | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting u... | 2026-09-22 |
| CVE-2026-94000 | medium | 6.6 | No | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-me... | 2026-09-22 |
| CVE-2026-93999 | medium | 4.2 | No | A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs d... | 2026-09-22 |
| CVE-2026-91203 | medium | 6.0 | No | A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition,... | 2026-09-22 |
| CVE-2026-87143 | high | 7.4 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-25275 | high | 7.5 | No | Transient DOS when processing authentication frames with invalid FILS information element header lengths. | 2026-09-22 |