Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85616 | high | 8.5 | No | Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Compan... | 2026-09-16 |
| CVE-2026-85617 | high | 8.8 | No | snipe-it versions before 8.6.3 contain an authorization bypass vulnerability in the bulk delete functionality that allows restricted users t... | 2026-09-16 |
| CVE-2026-85024 | medium | 5.9 | No | undici bundles a WebSocket client whose permessage-deflate size-limit cleanup removes all listeners from the internal zlib inflate stream, i... | 2026-09-16 |
| CVE-2026-85152 | high | 7.4 | No | undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is compos... | 2026-09-16 |
| CVE-2026-68849 | medium | 4.7 | No | Out-of-bounds read in Windows Bluetooth Port Driver allows an authorized attacker to disclose information locally. | 2026-09-16 |
| CVE-2026-18149 | medium | 5.9 | No | undici's retry handler can leave an already-exposed response body pending forever. When a server returns a successful response that declares... | 2026-09-16 |
| CVE-2026-18540 | low | 3.7 | No | undici's retry interceptor can append the body of a ranged retry response to bytes already delivered from an earlier partial response while... | 2026-09-16 |
| CVE-2026-19534 | high | 7.5 | No | undici's WebSocket client crashes the whole Node.js process during the opening handshake when a server responds with a subprotocol that the... | 2026-09-16 |
| CVE-2026-80176 | medium | 4.7 | No | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Plaintext Storage... | 2026-09-16 |
| CVE-2026-82052 | medium | 6.5 | No | The $regexFindAll expression can be used by an authenticated user who can run aggregation pipeline stages to crash a MongoDB server (mongod)... | 2026-09-16 |
| CVE-2026-82053 | high | 8.1 | No | A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities... | 2026-09-16 |
| CVE-2026-82054 | medium | 6.5 | No | A security issue exists in MongoDB server's JSON Pointer parser used during $jsonSchema query filter processing. When a find command include... | 2026-09-16 |
| CVE-2026-82075 | high | 7.5 | No | An uncontrolled resource consumption weakness exists in the request-handling path of the MongoDB sharded-cluster router process. A client th... | 2026-09-16 |
| CVE-2026-82074 | medium | 6.5 | No | MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges... | 2026-09-16 |
| CVE-2026-82073 | medium | 6.5 | No | A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level... | 2026-09-16 |
| CVE-2026-82071 | high | 8.1 | No | Insufficient validation of storage engine configuration options in MongoDB Server allows an authenticated user with write privileges to supp... | 2026-09-16 |
| CVE-2026-88975 | high | 7.5 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.37 and 1.0.0-M48, Ember’s HTTP/2 read loop parses a frame’s 24-bit declared len... | 2026-09-16 |
| CVE-2026-69217 | high | 8.7 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HTTP/1.1 parser accepts differing duplicate Content-L... | 2026-09-16 |
| CVE-2026-69215 | medium | 6.8 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware uses unanchored substring che... | 2026-09-16 |
| CVE-2026-69206 | medium | 5.9 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, DigestAuth replay protection records lastNc plus one instead... | 2026-09-16 |