Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86466 | high | 8.1 | No | Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_toke... | 2026-09-18 |
| CVE-2026-86462 | critical | 9.1 | No | Apache Airflow FAB provider: changing a user's password through the Admin user-edit PATCH endpoint does not invalidate that user's existing... | 2026-09-18 |
| CVE-2026-82311 | critical | 9.8 | No | Apache Airflow FAB provider: resetting a user's password does not delete that user's existing database-backed sessions, despite documented b... | 2026-09-18 |
| CVE-2026-82310 | high | 7.2 | No | Apache Airflow FAB provider: deactivating a user account does not stop tokens issued to that account before deactivation. Password authentic... | 2026-09-18 |
| CVE-2026-76187 | critical | 9.8 | No | Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client register... | 2026-09-18 |
| CVE-2026-75035 | medium | 6.5 | No | A flaw was found in Rancher Manager. When a non-administrative caller supplied a label selector naming a different user, the ext.cattle.io/v... | 2026-09-18 |
| CVE-2026-76186 | critical | 9.1 | No | Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token b... | 2026-09-18 |
| CVE-2026-75156 | critical | 9.1 | No | Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login.... | 2026-09-18 |
| CVE-2026-86891 | low | 3.5 | No | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS... | 2026-09-18 |
| CVE-2026-76000 | medium | 6.5 | No | ColdFusion is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. An attacker c... | 2026-09-18 |
| CVE-2026-76190 | high | 8.6 | No | ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could... | 2026-09-18 |
| CVE-2026-75993 | high | 8.5 | No | ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malic... | 2026-09-18 |
| CVE-2026-75998 | high | 7.5 | No | ColdFusion is affected by an Improper Access Control vulnerability that could lead to arbitrary file system read. An attacker could exploit... | 2026-09-18 |
| CVE-2026-76002 | medium | 6.1 | No | ColdFusion is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL r... | 2026-09-18 |
| CVE-2026-75746 | critical | 9.1 | No | ColdFusion is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could r... | 2026-09-18 |
| CVE-2026-75990 | high | 8.6 | No | Illustrator is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the curr... | 2026-09-18 |
| CVE-2026-75991 | high | 8.6 | No | Illustrator is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the cu... | 2026-09-18 |
| CVE-2026-93604 | high | 7.2 | No | vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto bui... | 2026-09-18 |
| CVE-2026-91732 | high | 8.1 | No | Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer proc... | 2026-09-18 |
| CVE-2026-91723 | low | 3.1 | No | Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML p... | 2026-09-18 |