Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89242 | high | 7.2 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode... | 2026-09-15 |
| CVE-2026-84042 | high | 7.8 | No | A flaw was found in crun. When crun is built with libkrun and a container is started rootful with passt networking (krun.use_passt), crun ca... | 2026-09-15 |
| CVE-2026-72708 | high | 7.5 | No | SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attac... | 2026-09-15 |
| CVE-2026-9176 | high | 7.1 | No | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to a security bypass due to improper authentication controls. A local attacker c... | 2026-09-15 |
| CVE-2026-9225 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.11.5 Langflow could allow an authenticated attacker to access sensitive files belonging to other users due... | 2026-09-15 |
| CVE-2026-9327 | high | 8.1 | No | IBM WebSphere Application Server 9.0, and 8.5 could allow an authenticated user with a low-privilege administrative role to modify security... | 2026-09-15 |
| CVE-2026-9667 | medium | 5.3 | No | IBM WebSphere Application Server 9.0, and 8.5 is vulnerable to server-side request forgery (SSRF) that could allow a remote, unauthenticated... | 2026-09-15 |
| CVE-2026-79513 | medium | 6.5 | No | A divide-by-zero vulnerability in the gf_dash_get_timeline_duration function (src/media_tools/dash_client.c) of GPAC v26.07.0 allows attacke... | 2026-09-15 |
| CVE-2026-79514 | medium | 6.5 | No | An out-of-bounds read in the gf_dm_data_received function (downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of Service (DoS... | 2026-09-15 |
| CVE-2026-79522 | medium | 6.5 | No | An out-of-bounds read in the gf_dm_get_chunk_data function (src/utils/downloader.c) of GPAC v26.07.0 allows attackers to cause a Denial of S... | 2026-09-15 |
| CVE-2026-87011 | high | 7.5 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, the unauthenticated POST /oau... | 2026-09-15 |
| CVE-2026-87012 | medium | 4.3 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, backend/open_webui/models/cal... | 2026-09-15 |
| CVE-2026-90805 | high | 7.3 | No | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknow... | 2026-09-15 |
| CVE-2026-90786 | medium | 5.3 | No | A vulnerability was determined in Dvidelabs flatcc up to 0.6.3. This impacts the function align_order_members of the file src/compiler/seman... | 2026-09-15 |
| CVE-2026-90698 | medium | 5.3 | No | A security flaw has been discovered in memcached 1.6.41/1.6.42/1.6.43. This vulnerability affects the function try_read_command_asciiauth of... | 2026-09-15 |
| CVE-2026-90688 | medium | 6.5 | No | A vulnerability was identified in Tenda W20E 15.11.0.61068_1546_841_CN_TDC. This issue affects the function formIPMacBindAdd of the componen... | 2026-09-15 |
| CVE-2026-78130 | high | 7.5 | No | strongSwan 4.2.0 through 6.0.7 has a NULL pointer dereference in the x509 plugin's attribute certificate parser. | 2026-09-15 |
| CVE-2026-78123 | medium | 5.9 | No | strongSwan 5.0.2 through 6.0.7 has an Expired Pointer Dereference in PKCS#7 parsing in the openssl plugin. | 2026-09-15 |
| CVE-2026-73028 | high | 8.8 | No | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 2026-09-15 |
| CVE-2026-73029 | medium | 6.5 | No | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |