Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73470 | critical | 9.8 | No | Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating... | 2026-09-14 |
| CVE-2026-73178 | high | 7.5 | No | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Syncope. An administrator with adequate entitlements can... | 2026-09-14 |
| CVE-2026-87802 | critical | 9.1 | No | Improper verification of cryptographic signature vulnerability in Apache Syncope. When SRA is configured for OAuth 2.0 without JWKS set URI... | 2026-09-14 |
| CVE-2026-87785 | critical | 9.1 | No | Authentication bypass by spoofing vulnerability in Apache Syncope. When the configured JWKS settings for internal JWT authentication are di... | 2026-09-14 |
| CVE-2026-87779 | high | 7.5 | No | Insertion of sensitive information into log file vulnerability in Apache Syncope. When AES key of non-standard length (not 16/24/32 bytes)... | 2026-09-14 |
| CVE-2026-86460 | critical | 9.8 | No | Cypher injection vulnerability in the Neo4j persistence layer when processing some FIQL search conditions. This issue affects Apache Syncop... | 2026-09-14 |
| CVE-2026-82232 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Syncope. An administrator with... | 2026-09-14 |
| CVE-2026-72524 | high | 8.8 | No | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access or modify data they... | 2026-09-14 |
| CVE-2026-68570 | medium | 6.5 | No | Incorrect Authorization vulnerability in Apache Doris allows an authenticated user to bypass privilege checks and access data they are not a... | 2026-09-14 |
| CVE-2026-90813 | medium | 4.3 | No | A vulnerability was detected in cosmicstack-labs mercury-agent up to 1.1.13. Affected is the function checkShellCommand of the file src/capa... | 2026-09-14 |
| CVE-2026-90811 | low | 3.3 | No | A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand... | 2026-09-14 |
| CVE-2026-90808 | medium | 6.3 | No | A vulnerability was determined in HKUDS nanobot up to 0.2.1. Impacted is the function ExecTool._guard_command/ExecTool._spawn of the file na... | 2026-09-14 |
| CVE-2026-90806 | medium | 6.3 | No | A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file ba... | 2026-09-14 |
| CVE-2026-90794 | medium | 6.3 | No | A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c... | 2026-09-14 |
| CVE-2026-90792 | medium | 4.3 | No | A flaw has been found in GPAC up to f1219cde. This issue affects the function gf_node_list_get_child of the file scenegraph/base_scenegraph.... | 2026-09-14 |
| CVE-2026-90789 | high | 7.3 | No | A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file... | 2026-09-14 |
| CVE-2026-90787 | high | 7.3 | No | A vulnerability was identified in Soarkey StudentManagement up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. Affected is the function Registe... | 2026-09-14 |
| CVE-2026-90784 | medium | 5.3 | No | A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compile... | 2026-09-14 |
| CVE-2026-90715 | high | 7.3 | No | A security vulnerability has been detected in marcobambini Gravity up to 0.9.7. This affects an unknown function of the file src/utils/gravi... | 2026-09-14 |
| CVE-2026-90712 | medium | 4.3 | No | A vulnerability was identified in Gitlawb openclaude up to 0.30.0. Impacted is the function waitForCallback of the file src/services/api/xai... | 2026-09-14 |