Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87183 | high | 7.7 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87185 | high | 8.8 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87186 | critical | 9.6 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87187 | high | 8.8 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87188 | critical | 9.8 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87189 | critical | 9.1 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-69720 | high | 7.8 | No | Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-72926 | high | 7.0 | No | Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-71224 | medium | 4.7 | No | A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height va... | 2026-09-22 |
| CVE-2026-71222 | medium | 6.3 | No | A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed... | 2026-09-22 |
| CVE-2026-71221 | high | 7.0 | No | A stack out-of-bounds write vulnerability was found in gfs2-utils. In savemeta, the height value from on-disk inode metadata is used as a lo... | 2026-09-22 |
| CVE-2026-71220 | high | 7.0 | No | A stack out-of-bounds write vulnerability was found in gfs2-utils. In gfs2_edit, the di_height field from on-disk inode metadata is used as... | 2026-09-22 |
| CVE-2026-71219 | medium | 4.7 | No | A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-deri... | 2026-09-22 |
| CVE-2026-84963 | medium | 5.3 | No | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value... | 2026-09-22 |
| CVE-2026-84964 | high | 7.5 | No | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that th... | 2026-09-22 |
| CVE-2026-95806 | not reported | — | No | MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper caus... | 2026-09-22 |
| CVE-2026-95805 | not reported | — | No | A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the perm... | 2026-09-22 |
| CVE-2026-95754 | not reported | — | No | In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification b... | 2026-09-22 |
| CVE-2026-95703 | not reported | — | No | In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MI... | 2026-09-22 |
| CVE-2026-95701 | not reported | — | No | In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checkin... | 2026-09-22 |