Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65391 | high | 8.8 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Safari 26.6.1, iOS 26.6.1 and iPadOS 26.6.1... | 2026-09-16 |
| CVE-2026-84003 | high | 7.4 | No | Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform sp... | 2026-09-16 |
| CVE-2026-82617 | critical | 9.8 | No | The two built-in name-finder patterns exposed by opennlp.tools.namefind.RegexNameFinderFactory - DEFAULT_REGEX_NAME_FINDER.EMAIL and DEFAULT... | 2026-09-16 |
| CVE-2026-67211 | high | 7.5 | No | OOM Denial of Service via Unbounded Map Pre-Sizing in Apache OpenNLP SymSpellModelSerializer Versions Affected: - 3.0.0-M4 - 3.0.0-M5 (T... | 2026-09-16 |
| CVE-2026-18061 | medium | 5.9 | No | Improper restriction of XML external entity references in the RemoteQueryCachePlugin in AWS Advanced JDBC Wrapper 3.3.0 through 4.2.0 might... | 2026-09-16 |
| CVE-2026-89332 | medium | 5.5 | No | Inclusion of functionality from an untrusted control sphere in the Kiro Powers feature in Amazon Kiro IDE before version 0.8.135 might allow... | 2026-09-16 |
| CVE-2026-91855 | medium | 5.3 | No | A security flaw has been discovered in Open5GS up to 2.7.7. Affected by this vulnerability is an unknown functionality of the file lib/pfcp/... | 2026-09-16 |
| CVE-2026-91990 | high | 7.5 | No | Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating... | 2026-09-16 |
| CVE-2026-48987 | medium | 6.5 | No | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, EventManager in src/pyload/core/managers/event... | 2026-09-16 |
| CVE-2026-92002 | not reported | — | No | Affected versions of MISP use Redis to throttle repeated authentication-failure log entries. The intent is to avoid excessive duplicate logs... | 2026-09-16 |
| CVE-2026-92003 | not reported | — | No | Affected versions of MISP do not consistently apply the existing authentication-failure logging throttle. Two API authentication failure br... | 2026-09-16 |
| CVE-2026-91859 | not reported | — | No | Affected versions of MISP can record incorrect access-log data for requests that terminate in an exception. Because CakeErrorController ext... | 2026-09-16 |
| CVE-2026-91857 | not reported | — | No | Affected versions of MISP expose several state-changing controller actions without restricting them to POST. The affected actions are: -... | 2026-09-16 |
| CVE-2026-91851 | not reported | — | No | Affected versions of MISP incorrectly filter dashboard templates that are restricted to a specific permission flag. DashboardsController::l... | 2026-09-16 |
| CVE-2026-91846 | not reported | — | No | Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is... | 2026-09-16 |
| CVE-2026-91825 | not reported | — | No | Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether t... | 2026-09-16 |
| CVE-2026-76159 | not reported | — | No | Incorrect Permission Assignment for Critical Resource in the configuration loader of Duplicati for Windows versions before v2.4.0.0 allows a... | 2026-09-16 |
| CVE-2026-91819 | not reported | — | No | Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. C... | 2026-09-16 |
| CVE-2026-76081 | medium | 5.5 | No | ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple proj... | 2026-09-16 |
| CVE-2026-65838 | high | 8.2 | No | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/ope... | 2026-09-16 |