Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

Vulnerabilities

Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.

Archives: September 2026 October 2026 CISA KEV / threat intelligence

CVESeverityCVSSKEVDescriptionModified (UTC)
CVE-2026-82763 medium 5.4 No Cross-site scripting vulnerability exists in Contec FX5000 series, FX4000 series, and FX3000 series. If this vulnerability is exploited, an... 2026-09-16
CVE-2026-82762 high 8.8 No Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in Contec FX5000 series, FX4000 seri... 2026-09-16
CVE-2026-68955 high 7.8 No The installer for Rakuten Kobo Desktop Application (Windows version) insecurely loads Dynamic Link Libraries. If there is a crafted DLL at t... 2026-09-16
CVE-2026-87727 medium 6.5 No a-blog cms Ver. 3.2.33 and earlier contains a path traversal vulnerability, which allows an unauthenticated attacker to read or delete arbit... 2026-09-16
CVE-2026-89156 medium 5.9 No PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data. 2026-09-16
CVE-2026-69646 high 8.3 No Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent... 2026-09-16
CVE-2026-69642 medium 6.1 No Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker t... 2026-09-16
CVE-2026-89157 high 7.4 No PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern. 2026-09-16
CVE-2026-66308 medium 6.5 No Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network. 2026-09-16
CVE-2026-12667 high 7.1 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-16
CVE-2026-11864 medium 6.5 No IBM Cloud Pak for Business Automation 26.0.0 through 26.0.0 Interim Fix 001, 25.0.0 through 25.0.0 Interim Fix 005, 24.0.1 through 24.0.1 In... 2026-09-16
CVE-2026-13265 medium 6.8 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-16
CVE-2026-12759 medium 6.5 No IBM Cloud Pak for Business Automation could allow an authenticated user to cause a denial of service due to uncontrolled resource consumptio... 2026-09-16
CVE-2026-12758 medium 5.4 No IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper... 2026-09-16
CVE-2026-78415 medium 5.4 No IBM Sterling Secure Proxy 6.2.0.0 through 6.2.1.2 could allow a remote authenticated attacker to perform UI spoofing and phishing attacks du... 2026-09-16
CVE-2026-19280 medium 5.2 No IBM i 7.6, 7.5, 7.4, and 7.3 could allow a denial of service as a result of a buffer overflow in a PASE process. An authenticated attacker c... 2026-09-16
CVE-2026-13287 high 7.1 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-16
CVE-2026-13277 medium 4.7 No IBM Verify Identity Access could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim... 2026-09-16
CVE-2026-13275 high 7.1 No IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... 2026-09-16
CVE-2026-13107 high 7.1 No IBM Business Automation Workflow containers and traditional may use programming model artifacts that are vulnerable to XML Entity Injection... 2026-09-16