Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80489 | medium | 5.9 | No | Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version... | 2026-09-18 |
| CVE-2026-77117 | medium | 5.9 | No | Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library versi... | 2026-09-18 |
| CVE-2026-19542 | medium | 5.6 | No | Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocat... | 2026-09-18 |
| CVE-2026-19499 | high | 7.7 | No | Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a c... | 2026-09-18 |
| CVE-2026-89044 | medium | 6.5 | No | Netty versions 4.1.133.Final through 4.1.137.Final and 4.2.13.Final through 4.2.17.Final fail to properly validate the final transfer coding... | 2026-09-18 |
| CVE-2026-88875 | medium | 4.3 | No | AVideo through revision c3edcc274c389816d434acadac07ee78eaf330c1 (master, 2026-08-23) incompletely sanitizes sensitive user fields in the AP... | 2026-09-18 |
| CVE-2026-88870 | high | 7.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the LoginControl... | 2026-09-18 |
| CVE-2026-88865 | high | 8.1 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate restream ownership in getRestream.json.php, allowing authen... | 2026-09-18 |
| CVE-2026-87928 | medium | 5.4 | No | MaxSite CMS versions 0.94 through 109.6 contain a cross-site scripting vulnerability in the admin_page upload handler that allows any logged... | 2026-09-18 |
| CVE-2026-87819 | high | 7.5 | No | GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author... | 2026-09-18 |
| CVE-2026-87814 | high | 7.3 | No | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the search asset preview feature that fails to escape indexed a... | 2026-09-18 |
| CVE-2026-87809 | medium | 6.5 | No | Siyuan before v3.8.2 fails to apply publish-access filtering to embedded blocks before rendering in the /api/export/preview and /api/lute/co... | 2026-09-18 |
| CVE-2026-87794 | high | 8.4 | No | bestzip versions 2.2.6 and 3.0.2 contain an argument injection vulnerability in the nativeZip function that allows attackers to inject arbit... | 2026-09-18 |
| CVE-2026-87169 | medium | 6.1 | No | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Wage Determinatio... | 2026-09-18 |
| CVE-2026-86744 | low | 2.2 | No | Snipe-IT 8.6.3 and earlier (and develop pre-release commits prior to the fix) contain a race condition in the asset checkout paths. Api\Asse... | 2026-09-18 |
| CVE-2026-86739 | medium | 6.5 | No | Snipe-IT 8.6.3 and earlier do not check the return value of Storage::put() when writing the signature PNG and the generated acceptance PDF i... | 2026-09-18 |
| CVE-2026-86416 | medium | 5.4 | No | ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and... | 2026-09-18 |
| CVE-2026-86255 | medium | 6.5 | No | wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbi... | 2026-09-18 |
| CVE-2026-86250 | high | 7.5 | No | h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteCh... | 2026-09-18 |
| CVE-2026-86194 | not reported | — | No | Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to... | 2026-09-18 |