Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93598 | not reported | — | No | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.a... | 2026-09-22 |
| CVE-2026-93593 | high | 8.1 | No | ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions fr... | 2026-09-22 |
| CVE-2026-93560 | high | 7.5 | No | A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceedi... | 2026-09-22 |
| CVE-2026-93506 | medium | 6.3 | No | A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the... | 2026-09-22 |
| CVE-2026-84449 | low | 3.7 | No | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.19.6, Op_RGB24_32_to_YCbCr::convert_colorspace() stores image-plane s... | 2026-09-22 |
| CVE-2026-84444 | high | 7.4 | No | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, when WITH_UNCOMPRESSED_CODEC is enabled, heif_context_add_image... | 2026-09-22 |
| CVE-2026-83425 | high | 8.5 | No | Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Internal Operations). Su... | 2026-09-22 |
| CVE-2026-83424 | high | 7.5 | No | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affec... | 2026-09-22 |
| CVE-2026-83419 | medium | 5.4 | No | Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEP... | 2026-09-22 |
| CVE-2026-83417 | high | 7.1 | No | Vulnerability in the Oracle Communications Cloud Native Core Security Edge Protection Proxy product of Oracle Communications (component: SEP... | 2026-09-22 |
| CVE-2026-83356 | high | 7.7 | No | Vulnerability in the Enterprise Command Center Framework product of Oracle E-Business Suite (component: Security). The supported version tha... | 2026-09-22 |
| CVE-2026-83354 | medium | 6.3 | No | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). The supported version that is affected is 15.1.... | 2026-09-22 |
| CVE-2026-83352 | high | 7.1 | No | Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12... | 2026-09-22 |
| CVE-2026-83308 | high | 8.1 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-22 |
| CVE-2026-83302 | high | 8.5 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Publisher Security). The supported version that is affec... | 2026-09-22 |
| CVE-2026-83300 | high | 7.1 | No | Vulnerability in the Oracle XML Gateway product of Oracle E-Business Suite (component: Install). Supported versions that are affected are 12... | 2026-09-22 |
| CVE-2026-83287 | high | 7.7 | No | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services). Support... | 2026-09-22 |
| CVE-2026-83277 | high | 7.3 | No | Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client). The supported version that is a... | 2026-09-22 |
| CVE-2026-75883 | medium | 6.8 | No | The code in pppd that formats a response to a PEAP Request packet in peap_response() copies an entire TLS record of up to 16384 bytes into t... | 2026-09-22 |
| CVE-2026-69693 | high | 7.0 | No | Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally. | 2026-09-22 |