Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69216 | medium | 5.4 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s chunk decoder trims the chunk-size token and accepts... | 2026-09-16 |
| CVE-2026-69214 | medium | 6.8 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The CookieJar client middleware stores a response cookie’s Do... | 2026-09-16 |
| CVE-2026-69211 | medium | 4.8 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, ResponseCookie.render writes attacker-influenced name, conten... | 2026-09-16 |
| CVE-2026-69209 | high | 7.5 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, The shared WebSocket decoder permits unbounded message buffer... | 2026-09-16 |
| CVE-2026-69204 | not reported | — | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember HTTP/1.1 does not reject messages containing both Trans... | 2026-09-16 |
| CVE-2026-82070 | medium | 6.5 | No | A security issue in MongoDB Server's diagnostic reporting interface allows an authenticated user with monitoring privileges to access insuff... | 2026-09-16 |
| CVE-2026-89186 | not reported | — | No | Use of Cache Containing Sensitive Information in ZenHive mpp allows a shared HTTP cache to store a paid response and serve it to clients tha... | 2026-09-16 |
| CVE-2026-88255 | not reported | — | No | Improper Validation of Unsafe Equivalence in Input in ZenHive mpp allows an unauthenticated remote client to pass the Tempo duplicate-submis... | 2026-09-16 |
| CVE-2026-86338 | not reported | — | No | Ash field_policies are documented to protect against filter-based information disclosure: when a field the actor may not see is referenced i... | 2026-09-16 |
| CVE-2026-92237 | medium | 6.5 | No | Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier... | 2026-09-16 |
| CVE-2026-79994 | not reported | — | No | The guest-to-host Unix-domain socket relay in Docker Sandboxes validates that a socket path is inside an authorized workspace, but later rec... | 2026-09-16 |
| CVE-2026-77179 | not reported | — | No | On macOS, the virtio-fs host server used by Docker Sandboxes improperly follows symlinks when reopening an unlinked file from a stored path.... | 2026-09-16 |
| CVE-2026-86836 | not reported | — | No | In Eclipse Ankaios versions 0.1.0 through 1.0.2, the agent creates workload files and Control Interface named pipes (FIFOs) under a predicta... | 2026-09-16 |
| CVE-2026-88819 | not reported | — | No | In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID. | 2026-09-16 |
| CVE-2026-78299 | critical | 9.1 | No | In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract f... | 2026-09-16 |
| CVE-2026-89321 | medium | 4.3 | No | Publishing limits the compressed size of a VSIX (ovsx.publishing.max-content-size, 512 MB by default) but nothing limited how large an entry... | 2026-09-16 |
| CVE-2026-82069 | medium | 6.5 | No | A security issue in MongoDB Server's query statistics serialization on the router allows users with monitoring privileges to access unredact... | 2026-09-16 |
| CVE-2026-82068 | medium | 6.5 | No | A security issue in MongoDB Server allows an authenticated user with write privileges to trigger a persistent fatal assertion crash by sendi... | 2026-09-16 |
| CVE-2026-69205 | high | 8.7 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, Ember’s HeaderP.parse uses a case-sensitive substring test fo... | 2026-09-16 |
| CVE-2026-69203 | high | 7.5 | No | Http4s is a Scala interface for HTTP services. Prior to 0.23.35 and 1.0.0-M47, An Ember server with HTTP/2 enabled through withHttp2 does no... | 2026-09-16 |