Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83068 | high | 7.7 | No | Vulnerability in the Oracle Enterprise Manager for Oracle Database product of Oracle Enterprise Manager (component: Core). The supported ver... | 2026-09-16 |
| CVE-2026-83067 | high | 8.1 | No | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: ADF Shared Components). Supported versions that are a... | 2026-09-16 |
| CVE-2026-73966 | high | 7.2 | No | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 1... | 2026-09-16 |
| CVE-2026-73955 | high | 7.3 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Charting). Supported versions that are affec... | 2026-09-16 |
| CVE-2026-73954 | high | 8.1 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink). Supported versions that... | 2026-09-16 |
| CVE-2026-70755 | medium | 6.5 | No | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). Supported ver... | 2026-09-16 |
| CVE-2026-62597 | medium | 6.5 | No | Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management). Supported v... | 2026-09-16 |
| CVE-2026-86818 | medium | 4.8 | No | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv, that added a mailto scheme parser in version 4.1.3.... | 2026-09-16 |
| CVE-2026-86472 | medium | 4.8 | No | fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7,... | 2026-09-16 |
| CVE-2026-90711 | critical | 9.1 | No | proxy-addr is a Node.js module that determines a request's client address behind trusted reverse proxies, and it backs Express req.ip and re... | 2026-09-16 |
| CVE-2026-17495 | medium | 5.9 | No | moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. In versions 2.29.2 through 2.30.1, a specia... | 2026-09-16 |
| CVE-2026-88932 | medium | 5.3 | No | multer is a Node.js middleware for handling multipart/form-data uploads. In versions 2.2.0 through 2.3.0, when a request using disk storage... | 2026-09-16 |
| CVE-2026-87776 | high | 7.5 | No | compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection while a compresse... | 2026-09-16 |
| CVE-2026-87859 | medium | 5.3 | No | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double... | 2026-09-16 |
| CVE-2026-87123 | medium | 5.9 | No | hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helpe... | 2026-09-16 |
| CVE-2026-87908 | high | 7.5 | No | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the pa... | 2026-09-16 |
| CVE-2026-43741 | medium | 5.5 | No | A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.... | 2026-09-16 |
| CVE-2026-75624 | high | 8.8 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass... | 2026-09-16 |
| CVE-2026-78135 | high | 7.3 | No | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are... | 2026-09-16 |
| CVE-2023-37253 | low | 3.1 | No | An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the AP... | 2026-09-16 |