Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84447 | high | 7.5 | No | libheif is a HEIF and AVIF file format decoder and encoder. In 1.23.1 and earlier, crafted grid, iovl, and iden reference graphs can repeate... | 2026-09-18 |
| CVE-2026-86176 | medium | 4.3 | No | NetBox through 4.7.0 fails to properly scope user-private records in REST and GraphQL API endpoints for Notifications, Subscriptions, and Bo... | 2026-09-18 |
| CVE-2026-84384 | high | 7.5 | No | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.2, crafted HEIF or AVIF mime metadata and unci image data... | 2026-09-18 |
| CVE-2026-83314 | high | 8.1 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API). Supported versions that are affected are... | 2026-09-18 |
| CVE-2026-83313 | high | 7.7 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-18 |
| CVE-2026-83312 | high | 7.7 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: E-Business Suite - XDO). Supported versions that are affect... | 2026-09-18 |
| CVE-2026-81178 | low | 3.5 | No | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receiv... | 2026-09-18 |
| CVE-2026-75584 | high | 7.5 | No | ION-DTN before 4.2.1-a.1 contains a denial of service vulnerability that allows unauthenticated remote attackers to crash the ION process by... | 2026-09-18 |
| CVE-2026-74909 | high | 8.1 | No | Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was... | 2026-09-18 |
| CVE-2026-61633 | low | 2.0 | No | NanoMQ is an MQTT broker. Prior to 0.24.14, the NanoMQ client function nni_mqtt_msg_decode_unsubscribe() in nng/src/supplemental/mqtt/mqtt_c... | 2026-09-18 |
| CVE-2026-56711 | high | 7.0 | No | VLC media player versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing crafted media. Exploitation r... | 2026-09-18 |
| CVE-2026-44639 | low | 3.7 | No | NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's MQTT v5 property decoder in nng/src/supplemental/mqtt/mqtt_codec.c uses property_append... | 2026-09-18 |
| CVE-2026-27563 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a crafted G... | 2026-09-18 |
| CVE-2026-27558 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/ajax_remove_uploaded_i... | 2026-09-18 |
| CVE-2026-26947 | medium | 6.7 | No | Dell ECS versions 3.8.1.0 through 3.8.1.7, and Dell ObjectScale versions prior to 4.4.0.0, contains an Improper Privilege Management vulnera... | 2026-09-18 |
| CVE-2026-27548 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using user... | 2026-09-18 |
| CVE-2026-18555 | medium | 6.1 | No | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scr... | 2026-09-18 |
| CVE-2026-12645 | high | 8.8 | No | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary c... | 2026-09-18 |
| CVE-2026-86688 | not reported | — | No | Session Fixation vulnerability in team-alembic ash_authentication allows an attacker who can plant a session identifier in a victim's browse... | 2026-09-18 |
| CVE-2026-76949 | not reported | — | No | Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who can plant a remember-me cookie in... | 2026-09-18 |