Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-20194 | critical | 9.1 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Identity Services Engine (ISE) and Cisco ISE Pass... | 2026-09-18 |
| CVE-2026-78668 | not reported | — | No | Rejected reason: reserved but not needed | 2026-09-17 |
| CVE-2026-84565 | high | 7.1 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... | 2026-09-17 |
| CVE-2026-84544 | high | 7.5 | No | An integer overflow was addressed with improved input validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tah... | 2026-09-17 |
| CVE-2026-84533 | medium | 5.3 | No | A cryptographic issue was addressed with improved integrity checks. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, tvOS... | 2026-09-17 |
| CVE-2026-68536 | critical | 9.8 | No | Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected. Users are reco... | 2026-09-17 |
| CVE-2026-43696 | medium | 5.3 | No | An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to ca... | 2026-09-17 |
| CVE-2026-63472 | critical | 9.1 | No | Vendure is an open-source headless commerce platform. Prior to 3.7.0, ExternalAuthenticationService.createCustomerAndUser in packages/core/s... | 2026-09-17 |
| CVE-2026-63461 | medium | 5.3 | No | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop API products, collections, and facets queries combine... | 2026-09-17 |
| CVE-2026-63460 | high | 7.5 | No | Vendure is an open-source headless commerce platform. Prior to 3.6.5, the public Shop GraphQL API allows an unauthenticated caller to supply... | 2026-09-17 |
| CVE-2026-54587 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, directory assets handled as ASSET_DIR or ASSET_DIR_OWNER_MODE in libmport/bundle_r... | 2026-09-17 |
| CVE-2026-54585 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, create_sample_file() in libmport/bundle_read_install_pkg.c did not constrain absol... | 2026-09-17 |
| CVE-2026-54583 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-contain... | 2026-09-17 |
| CVE-2026-54582 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets th... | 2026-09-17 |
| CVE-2026-54581 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_bootstrap_index() function in libmport/fetch.c could return succes... | 2026-09-17 |
| CVE-2026-92992 | medium | 6.3 | No | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server... | 2026-09-17 |
| CVE-2026-92926 | high | 7.3 | No | A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the fil... | 2026-09-17 |
| CVE-2026-92879 | medium | 4.3 | No | A security flaw has been discovered in vgmstream up to r2117. This issue affects the function parse_mus of the file src/meta/mus_acm.c. The... | 2026-09-17 |
| CVE-2026-90986 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Visitor Traffic Real Time Statistics Pro <= 11.21 versions. | 2026-09-17 |
| CVE-2026-90887 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Inventory Manager <= 2.5.4 versions. | 2026-09-17 |