Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-11539 | medium | 5.3 | No | IBM WebSphere Application Server 9.0 and 8.5 is affected by an authentication bypass vulnerability in the SOAP/JMX connector. | 2026-09-22 |
| CVE-2026-24081 | high | 7.4 | No | Transient DOS when processing a channel map with insufficient used channels and adaptive frequency hopping is fully enabled. | 2026-09-22 |
| CVE-2026-25261 | high | 7.8 | No | Memory corruption while processing rear sensor IOCTL calls. | 2026-09-22 |
| CVE-2026-25278 | high | 7.0 | No | Memory Corruption when processing I2C transfer requests due to a race condition between memory allocation and data copying. | 2026-09-22 |
| CVE-2026-87148 | high | 7.5 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-69649 | high | 8.8 | No | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | 2026-09-22 |
| CVE-2026-95660 | medium | 6.3 | No | A security flaw has been discovered in Moonshot AI Kimi Code up to 0.31.0. The affected element is an unknown function of the file agent-cor... | 2026-09-22 |
| CVE-2026-94384 | high | 8.1 | No | Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission... | 2026-09-22 |
| CVE-2026-95501 | medium | 4.3 | No | A vulnerability was found in mtrano APENCMS up to 6546096d354153309693efabb9a0d824628ed4f5. The affected element is the function eval of the... | 2026-09-22 |
| CVE-2026-94491 | high | 7.3 | No | A weakness has been identified in Yonyou KSOA 9.0. This affects an unknown part of the file /cardcase/search_list.jsp. Executing a manipulat... | 2026-09-22 |
| CVE-2026-94016 | low | 2.4 | No | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_rec... | 2026-09-22 |
| CVE-2026-93960 | medium | 4.3 | No | A vulnerability was identified in Pixelfed up to 0.12.11. Impacted is the function instancePeers of the file app/Http/Controllers/Api/ApiV1C... | 2026-09-22 |
| CVE-2026-93088 | critical | 9.8 | No | SGLang's multimodal generation runtime is vulnerable to unauthenticated arbitrary code execution because the disaggregated-diffusion orchest... | 2026-09-22 |
| CVE-2026-93018 | medium | 5.5 | No | Imager versions before 1.036 for Perl disclose uninitialised heap memory reading a paletted image with pixel indexes past its colour map in... | 2026-09-22 |
| CVE-2026-93312 | medium | 4.3 | No | A flaw has been found in Freedesktop Poppler 26.07.0. Impacted is the function JBIG2Stream::rewind of the file poppler/JBIG2Stream.cc. This... | 2026-09-22 |
| CVE-2026-90997 | high | 7.4 | No | A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database... | 2026-09-22 |
| CVE-2026-86062 | medium | 6.1 | No | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, lightrag_webui/src/components/retrieval/ChatMessage.tsx re... | 2026-09-22 |
| CVE-2026-85709 | medium | 5.3 | No | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the LightRAG API server returns raw Python exception text... | 2026-09-22 |
| CVE-2026-86698 | not reported | — | No | Insufficient Session Expiration vulnerability in OAuth token issuance in hexpm hexpm allows a user whose organization membership or session... | 2026-09-22 |
| CVE-2026-81897 | medium | 5.4 | No | In Concrete CMS below CMS 9.5.3, the save_control action in the Express entities forms dashboard controller did not validate the anti-CSRF t... | 2026-09-22 |