Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-71163 | critical | 9.9 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73926 | high | 8.7 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73940 | critical | 9.8 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73941 | high | 8.6 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-86887 | low | 3.3 | No | A privacy issue was addressed by removing sensitive data. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, visionOS 27... | 2026-09-21 |
| CVE-2026-86888 | low | 3.3 | No | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Tah... | 2026-09-21 |
| CVE-2026-73944 | critical | 9.1 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73948 | critical | 9.9 | No | Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer). Supported versions that are affected... | 2026-09-21 |
| CVE-2026-73946 | critical | 9.1 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-73945 | critical | 9.9 | No | Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). Supported versions that a... | 2026-09-21 |
| CVE-2026-81925 | medium | 6.1 | No | Concrete CMS before 9.5.3 improperly neutralized a user-supplied custom date format when rendering conversation messages, resulting in refle... | 2026-09-21 |
| CVE-2026-18426 | medium | 6.5 | No | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions,... | 2026-09-21 |
| CVE-2026-81926 | medium | 6.1 | No | Concrete CMS 9.4.0 through 9.5.2 did not escape colliding page paths before rendering them in the location panel's duplicate-path confirmati... | 2026-09-21 |
| CVE-2026-85385 | critical | 9.6 | No | Concrete CMS below 9.5.4 did not validate the user timezone value (uTimezone) on write and rendered it without output encoding on the Dashbo... | 2026-09-21 |
| CVE-2026-85386 | medium | 6.1 | No | Concrete CMS before 9.5.4 did not sanitize XML and XSLT documents uploaded through a public Form Block file-upload question. Plain XML uploa... | 2026-09-21 |
| CVE-2026-86358 | high | 8.8 | No | Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker... | 2026-09-21 |
| CVE-2026-87028 | medium | 6.5 | No | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board i... | 2026-09-21 |
| CVE-2026-87031 | low | 2.7 | No | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Contr... | 2026-09-21 |
| CVE-2026-18120 | medium | 5.9 | No | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpress... | 2026-09-21 |
| CVE-2026-85387 | high | 7.1 | No | Concrete CMS before 9.5.4 re-authorized OAuth REST API requests from the bearer token alone and did not re-check the state of the account th... | 2026-09-21 |