Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

Vulnerabilities

Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.

Archives: September 2026 October 2026 CISA KEV / threat intelligence

CVESeverityCVSSKEVDescriptionModified (UTC)
CVE-2026-69210 high 7.5 No Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, WebSocket FrameTranscoder.bodyLength rejects extended payload... 2026-09-17
CVE-2026-69213 high 7.5 No Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/2 serializes outbound frames through one unbounded... 2026-09-17
CVE-2026-69208 high 7.5 No Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, the DigestAuth server middleware removes fresh nonces and sto... 2026-09-17
CVE-2026-65381 critical 10.0 No A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. Th... 2026-09-17
CVE-2026-65378 high 7.5 No An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS... 2026-09-17
CVE-2026-43790 critical 9.1 No The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A... 2026-09-17
CVE-2026-12666 high 8.1 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-17
CVE-2026-12150 high 7.0 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-17
CVE-2026-11928 critical 9.8 No IBM Verify Identity Access is vulnerable to a buffer overflow attack. 2026-09-17
CVE-2026-11921 critical 9.1 No IBM Verify Identity Access containers may not apply management password change operations correctly. 2026-09-17
CVE-2026-43787 medium 5.9 No A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An atta... 2026-09-17
CVE-2026-84509 medium 6.5 No An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... 2026-09-17
CVE-2026-84570 medium 4.4 No A logic issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app... 2026-09-17
CVE-2026-84573 medium 5.5 No This issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may... 2026-09-17
CVE-2026-84587 medium 5.5 No A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe... 2026-09-17
CVE-2026-92985 high 8.8 No SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can... 2026-09-17
CVE-2026-92962 not reported — No vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function... 2026-09-17
CVE-2026-92952 medium 6.8 No vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filte... 2026-09-17
CVE-2026-92947 critical 10.0 No vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat... 2026-09-17
CVE-2026-92941 critical 10.0 No vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertifi... 2026-09-17