Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87240 | high | 7.0 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-21 |
| CVE-2026-87211 | high | 7.5 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-21 |
| CVE-2026-87212 | high | 7.4 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-21 |
| CVE-2026-81796 | high | 7.3 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in WEN Solutions WP Travel wp-travel allows Password Recovery Exploit... | 2026-09-21 |
| CVE-2026-93380 | low | 3.1 | No | Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and... | 2026-09-21 |
| CVE-2026-90839 | not reported | — | No | Rejected reason: this is rejected | 2026-09-21 |
| CVE-2026-83284 | high | 8.6 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-21 |
| CVE-2026-83242 | high | 7.3 | No | Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Ma... | 2026-09-21 |
| CVE-2026-87159 | high | 8.1 | No | Vulnerability in the Oracle HRMS (India) product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are af... | 2026-09-21 |
| CVE-2026-87963 | high | 8.6 | No | The Yo WordPress plugin from 1.1 through 1.3.1 does not sanitize or parameterize the username request parameter before using it in a SQL que... | 2026-09-20 |
| CVE-2026-91966 | medium | 5.8 | No | AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accep... | 2026-09-20 |
| CVE-2026-90971 | medium | 6.5 | No | Server-Side Request Forgery (SSRF) in the VMware synchronization feature in Devolutions Server 2026.2.16 and earlier allows a low-privileged... | 2026-09-20 |
| CVE-2026-91941 | high | 7.5 | No | Crawl4AI before 0.9.3 contains an uncontrolled resource consumption vulnerability in PDFContentScrapingStrategy that allows untrusted client... | 2026-09-20 |
| CVE-2026-91935 | high | 8.3 | No | Flowise before 3.1.4 fails to validate baseURL parameters in chat-model nodes, allowing authenticated users to redirect requests to arbitrar... | 2026-09-20 |
| CVE-2026-91836 | low | 2.8 | No | A flaw has been found in OpenClaw ClawScan up to 0.1.6. This affects an unknown function of the file internal/runner/static_scanner.go of th... | 2026-09-20 |
| CVE-2026-90969 | medium | 6.5 | No | Improper access control in the vault entry listing feature in Devolutions Server 2026.2.16 and earlier allows an authenticated user lacking... | 2026-09-20 |
| CVE-2026-90525 | medium | 6.3 | No | A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/cust_pos_... | 2026-09-20 |
| CVE-2026-90520 | medium | 6.3 | No | A vulnerability has been found in jaychouchannel Tourism-Management-System up to 84d8ec384f669df3985293dab293bb7b477efa64. This vulnerabilit... | 2026-09-20 |
| CVE-2026-90515 | high | 7.3 | No | A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the... | 2026-09-20 |
| CVE-2026-90509 | high | 7.3 | No | A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of... | 2026-09-20 |