Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77480 | high | 8.8 | No | Insufficient granularity of access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 2026-09-15 |
| CVE-2026-77482 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an unauthorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-87013 | medium | 4.3 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/v1/folders/{id}/up... | 2026-09-15 |
| CVE-2026-77483 | high | 8.8 | No | Weak authentication in SQL Server allows an authorized attacker to elevate privileges over a network. | 2026-09-15 |
| CVE-2026-77484 | high | 8.8 | No | Deserialization of untrusted data in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-77485 | high | 7.0 | No | Use after free in SQL Server allows an authorized attacker to elevate privileges locally. | 2026-09-15 |
| CVE-2026-87014 | medium | 6.5 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 until 0.11.1, role synchronization in backe... | 2026-09-15 |
| CVE-2026-87015 | medium | 6.8 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.27 until 0.11.1, backend/open_webui/utils/too... | 2026-09-15 |
| CVE-2026-77486 | high | 8.8 | No | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-77487 | high | 8.8 | No | Improper access control in SQL Server allows an authorized attacker to elevate privileges over a network. | 2026-09-15 |
| CVE-2019-7105 | critical | 9.8 | No | Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. | 2026-09-15 |
| CVE-2019-7106 | critical | 9.8 | No | Adobe XD versions 16.0 and earlier have a path traversal vulnerability. Successful exploitation could lead to arbitrary code execution. | 2026-09-15 |
| CVE-2026-87016 | high | 8.1 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.6.41 until 0.11.1, get_user_by_oauth_sub and ge... | 2026-09-15 |
| CVE-2026-18905 | high | 7.7 | No | IBM ContextForge MCP Gateway (`mcp-contextforge-gateway`) <= v1.0.6 MCP Context Forge could allow a remote authenticated attacker to obtain... | 2026-09-15 |
| CVE-2026-91091 | medium | 4.3 | No | A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf_node_list_insert_child of the file scenegraph... | 2026-09-15 |
| CVE-2026-91088 | medium | 4.8 | No | A vulnerability has been found in GPAC up to f1219cde. This issue affects the function gf_url_concatenate_ex of the file utils/url.c of the... | 2026-09-15 |
| CVE-2026-91086 | medium | 6.3 | No | A security vulnerability has been detected in GPAC up to f1219cde. Affected by this issue is the function mpgviddmx_process of the file filt... | 2026-09-15 |
| CVE-2026-91004 | high | 7.3 | No | A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the fil... | 2026-09-15 |
| CVE-2026-91003 | critical | 9.1 | No | A flaw has been found in D-Link DI-8300 16.07. The affected element is the function rzgl_asp of the file /rzgl.asp of the component CGI Serv... | 2026-09-15 |
| CVE-2026-91001 | critical | 9.9 | No | A security flaw has been discovered in D-Link DI-8400 16.07. This affects the function ddns_asp of the file /ddns.asp of the component DDNS... | 2026-09-15 |