Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65376 | medium | 5.5 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... | 2026-09-18 |
| CVE-2026-65358 | medium | 4.7 | No | A race condition was addressed with improved state handling. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, macOS Sequoi... | 2026-09-18 |
| CVE-2026-65375 | high | 7.5 | No | The issue was addressed with improved authentication. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.6. An... | 2026-09-18 |
| CVE-2026-65357 | high | 7.8 | No | The issue was addressed with improved memory handling. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, tvOS 26.6, visionO... | 2026-09-18 |
| CVE-2026-69587 | high | 7.5 | No | Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network. | 2026-09-18 |
| CVE-2026-65371 | low | 3.3 | No | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Sequoia 15... | 2026-09-18 |
| CVE-2026-65354 | high | 8.2 | No | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27. A malicio... | 2026-09-18 |
| CVE-2026-65361 | medium | 5.5 | No | This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may... | 2026-09-18 |
| CVE-2026-43683 | high | 7.1 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... | 2026-09-18 |
| CVE-2026-84602 | medium | 5.5 | No | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Gold... | 2026-09-18 |
| CVE-2026-28836 | medium | 6.1 | No | A correctness issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.8.8. An attacker with physical access may be... | 2026-09-18 |
| CVE-2026-75034 | high | 7.4 | No | A flaw was found in Rancher Manager. The SAML assertion replay protection introduced by the fix for CVE-2026-44946 recorded consumed asserti... | 2026-09-18 |
| CVE-2026-74761 | high | 7.5 | No | Improper input validation in TopicRegion in Apache ActiveMQ, Apache ActiveMQ Broker, and Apache ActiveMQ All on all platforms. An authentic... | 2026-09-18 |
| CVE-2026-84439 | medium | 5.3 | No | When audit logging is enabled (zookeeper.audit.enable=true), an unauthenticated attacker can inject arbitrary fields into Apache ZooKeeper's... | 2026-09-18 |
| CVE-2026-79993 | high | 7.5 | No | The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to del... | 2026-09-18 |
| CVE-2026-59739 | high | 7.5 | No | Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted... | 2026-09-18 |
| CVE-2026-84501 | medium | 5.3 | No | An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add_auth("ensem... | 2026-09-18 |
| CVE-2026-69588 | high | 7.5 | No | Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network. | 2026-09-18 |
| CVE-2026-59969 | high | 7.5 | No | Apache ZooKeeper quorum TLS fails to enforce peer hostname verification in FIPS-mode deployments. When sslQuorum=true, zookeeper.fips-mode=t... | 2026-09-18 |
| CVE-2026-86792 | high | 8.8 | No | Apache Airflow Apache Kafka provider versions 1.15.0 before 2.0.0 resolve dotted-path strings found in a Kafka connection's `extra` field in... | 2026-09-18 |