Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92417 | medium | 6.5 | No | A vulnerability was found in Open5GS up to 2.8.0. This affects the function ogs_pfcp_parse_volume_measurement in the library lib/pfcp/types.... | 2026-09-22 |
| CVE-2026-92402 | medium | 6.3 | No | A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index... | 2026-09-22 |
| CVE-2026-92365 | medium | 4.3 | No | A vulnerability was found in vllm-project vllm up to 0.29.0. Affected by this issue is some unknown functionality of the file vllm/v1/sample... | 2026-09-22 |
| CVE-2026-92221 | medium | 4.7 | No | A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this vulnerabil... | 2026-09-22 |
| CVE-2026-92214 | low | 3.5 | No | A flaw has been found in a2ui-project a2ui up to 0.10.7. Affected is an unknown function of the file samples/community/client/angular/projec... | 2026-09-22 |
| CVE-2026-91854 | medium | 4.3 | No | A vulnerability was identified in code-projects Record Management System 1.0. Affected is an unknown function of the file main/reg.php. Such... | 2026-09-22 |
| CVE-2026-83279 | medium | 5.5 | No | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is a... | 2026-09-22 |
| CVE-2026-81180 | high | 8.8 | No | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.61, authenticated users of SysReptor Professional can upload ima... | 2026-09-22 |
| CVE-2026-79919 | medium | 6.3 | No | MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox... | 2026-09-22 |
| CVE-2026-79917 | medium | 6.5 | No | MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat... | 2026-09-22 |
| CVE-2026-79916 | critical | 9.1 | No | MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into... | 2026-09-22 |
| CVE-2026-75607 | high | 8.1 | No | Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected m... | 2026-09-22 |
| CVE-2026-77520 | medium | 5.4 | No | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user'... | 2026-09-22 |
| CVE-2026-84965 | medium | 5.5 | No | An integer wraparound in an allocation size calculation in the BSON library's JSON parsing code can cause a buffer to be released while a fo... | 2026-09-22 |
| CVE-2026-84966 | medium | 5.5 | No | An incorrect numeric type conversion in the BSON document building component of the MongoDB C++ Driver may cause a length value to be interp... | 2026-09-22 |
| CVE-2026-84658 | medium | 4.3 | No | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier uses the `@DataBoundConstructor` annotation on a constructor that loads scrip... | 2026-09-22 |
| CVE-2026-69682 | high | 7.0 | No | Use after free in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-69689 | high | 8.8 | No | Out-of-bounds read in Windows Win32K allows an authorized attacker to elevate privileges over a network. | 2026-09-22 |
| CVE-2026-95511 | not reported | — | No | Rejected reason: Not a vulnerability. Creating a serial queue that overwrites cups-files.conf requires membership in SystemGroups (lpadmin),... | 2026-09-22 |
| CVE-2026-93603 | critical | 10.0 | No | vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): wh... | 2026-09-22 |