Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-40530 | high | 8.0 | No | An improper neutralization of CRLF sequences ('CRLF injection') vulnerability in User API in Synology DiskStation Manager (DSM) before 7.2.1... | 2026-09-18 |
| CVE-2026-13683 | low | 2.7 | No | An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology Disk... | 2026-09-18 |
| CVE-2026-13623 | medium | 4.8 | No | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Theme API in Synology DiskStation M... | 2026-09-18 |
| CVE-2026-28326 | high | 8.8 | No | SolarWinds Access Rights Manager was reported to be affected by an unauthenticated remote code execution vulnerability. The issue stems from... | 2026-09-18 |
| CVE-2026-92903 | high | 8.2 | No | Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL s... | 2026-09-18 |
| CVE-2026-90982 | medium | 5.3 | No | @fastify/static is a Fastify plugin that serves static files from a configured root directory. In versions before 10.1.4, on a case-insensit... | 2026-09-18 |
| CVE-2026-8462 | not reported | — | No | SQL injection in ClickHouse-backed meter definitions in OpenMeter OpenMeter before v1.0.0-beta.228 on all platforms allows a remote unauthen... | 2026-09-18 |
| CVE-2026-14916 | not reported | — | No | A JWT signature verification vulnerability affects Kong components that perform JWT validation for MCP OAuth2 or DataKit integrations inside... | 2026-09-18 |
| CVE-2026-14917 | not reported | — | No | A SAML authentication bypass vulnerability affects the Kong SAML plugin when the validate_assertion_signature option is explicitly set to fa... | 2026-09-18 |
| CVE-2026-75031 | critical | 9.8 | No | In the interchange/interchange project, a critical remote code execution (RCE) vulnerability was found in the “quick question” admin featur... | 2026-09-18 |
| CVE-2026-93653 | medium | 5.5 | No | A denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary ca... | 2026-09-18 |
| CVE-2026-93578 | medium | 5.9 | No | A flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Ke... | 2026-09-18 |
| CVE-2026-93493 | medium | 5.9 | No | A flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Cert... | 2026-09-18 |
| CVE-2026-71568 | medium | 5.3 | No | In BMCtest, Ironic is started without authentication and TLS for the duration of the test. Exploiting the problem requires winning the race... | 2026-09-18 |
| CVE-2026-92904 | medium | 4.3 | No | A flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resol... | 2026-09-18 |
| CVE-2026-92893 | medium | 4.3 | No | A flaw was found in the foreman_ansible plugin's Ansible inventory API. The controller builds its host query using an unscoped Host.where ca... | 2026-09-18 |
| CVE-2026-92894 | medium | 4.3 | No | A flaw was found in the foreman_ansible plugin's Ansible override values API. The destroy action resolves the target LookupValue record by I... | 2026-09-18 |
| CVE-2026-85469 | high | 8.0 | No | A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream `Noelware/docker-manifest-action` u... | 2026-09-18 |
| CVE-2026-15579 | not reported | — | No | An out-of-bounds write vulnerability exists in some of the Ethernet switches because of improper validation of the username field length dur... | 2026-09-18 |
| CVE-2026-67399 | not reported | — | No | Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. | 2026-09-18 |