Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78224 | high | 8.2 | No | The XSLT Transformer Step builds a bare TransformerFactory without the proper security options set, so XXE injection can allow data exfiltra... | 2026-09-18 |
| CVE-2026-38058 | high | 8.1 | No | The endpoint on the iDirect iQ200 VSAT terminal returns the complete device configuration as JSON, including the SECURITY section which cont... | 2026-09-18 |
| CVE-2026-84507 | high | 7.8 | No | A race condition was addressed with improved state handling. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Go... | 2026-09-18 |
| CVE-2026-84524 | medium | 4.3 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, ma... | 2026-09-18 |
| CVE-2026-66887 | critical | 9.6 | No | The affected products are missing authorization on state-changing CGIs and session checks are not performed. | 2026-09-18 |
| CVE-2026-66372 | medium | 6.8 | No | The affected products use insufficiently random values, which allows web session tokens to be predictable, bounding token entropy to the see... | 2026-09-18 |
| CVE-2026-84526 | medium | 4.3 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS... | 2026-09-18 |
| CVE-2026-84532 | medium | 5.4 | No | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS... | 2026-09-18 |
| CVE-2026-82567 | medium | 6.3 | No | The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The... | 2026-09-18 |
| CVE-2026-73807 | critical | 9.8 | No | The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with ne... | 2026-09-18 |
| CVE-2026-84626 | low | 3.3 | No | An information disclosure issue was addressed with improved state management. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iP... | 2026-09-18 |
| CVE-2026-38056 | high | 8.8 | No | A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount sat... | 2026-09-18 |
| CVE-2026-93652 | high | 7.5 | No | Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS | 2026-09-18 |
| CVE-2026-76154 | high | 7.3 | No | A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrar... | 2026-09-18 |
| CVE-2026-92611 | not reported | — | No | In Eclipse Ankaios versions 0.6.0 to before 1.0.4, `LogRule::matches` in the agent control-interface authorizer stops at the first wildcard... | 2026-09-18 |
| CVE-2026-89084 | not reported | — | No | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio... | 2026-09-18 |
| CVE-2026-89083 | not reported | — | No | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio... | 2026-09-18 |
| CVE-2026-89082 | not reported | — | No | HP has identified potential security vulnerabilities in the HP Advance software that may enable elevation of privilege, remote code executio... | 2026-09-18 |
| CVE-2026-92627 | not reported | — | No | A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c in HDF5 before 1.14.2. When converting a compound datatype co... | 2026-09-18 |
| CVE-2026-91843 | critical | 9.8 | No | A stack overflow during the unauthenticated login process may allow an attacker to run arbitrary code remotely with root privileges. | 2026-09-18 |