Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19407 | not reported | — | No | Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Rem... | 2026-09-21 |
| CVE-2026-69586 | critical | 9.8 | No | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | 2026-09-21 |
| CVE-2026-69597 | high | 7.5 | No | Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. | 2026-09-21 |
| CVE-2026-92954 | high | 8.6 | No | vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host r... | 2026-09-21 |
| CVE-2026-92949 | medium | 4.0 | No | vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts... | 2026-09-21 |
| CVE-2026-92467 | high | 8.3 | No | zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that a... | 2026-09-21 |
| CVE-2026-83265 | high | 8.2 | No | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). Supported versions tha... | 2026-09-21 |
| CVE-2026-83259 | high | 7.1 | No | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The s... | 2026-09-21 |
| CVE-2026-83252 | high | 7.0 | No | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge). The s... | 2026-09-21 |
| CVE-2026-85150 | high | 7.5 | No | A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WW... | 2026-09-21 |
| CVE-2026-77568 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-15747. Reason: This candidate is a duplicate of CVE-202... | 2026-09-21 |
| CVE-2026-68914 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-14803. Reason: This candidate is a duplicate of CVE-202... | 2026-09-21 |
| CVE-2026-76871 | medium | 6.5 | No | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in mod_vpn_remote/plan.json, pptpd_user_show.cg... | 2026-09-21 |
| CVE-2026-76866 | high | 7.2 | No | Netcore NR255-V firmware version 1.5.130703 builds root-run command lines from unquoted user-supplied DDNS input in DDNSset_cgi.c and relate... | 2026-09-21 |
| CVE-2026-81531 | not reported | — | No | An information disclosure vulnerability has been identified in Omada Controller. An API endpoint intended for Controller initialization rema... | 2026-09-21 |
| CVE-2026-69625 | high | 8.8 | No | Heap-based buffer overflow in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges over a ne... | 2026-09-21 |
| CVE-2026-92612 | not reported | — | No | In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::as... | 2026-09-21 |
| CVE-2026-73947 | critical | 9.8 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73950 | critical | 9.8 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73958 | high | 8.1 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |