Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75439 | high | 7.5 | No | An issue in Free5GC v.4.2.2 allows a remote attacker to cause a denial of service via the UPF component | 2026-09-14 |
| CVE-2026-78849 | medium | 5.4 | No | Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote... | 2026-09-14 |
| CVE-2026-75429 | critical | 9.8 | No | PowerJob versions 4.x through 5.1.2 contain an unauthenticated remote code execution vulnerability in the /friend/process endpoint of the Se... | 2026-09-14 |
| CVE-2026-75171 | critical | 9.8 | No | An issue in HubCore v.14.1.1 allows a remote attacker to escalate privileges via the HUBCOREID session cookie handling component. | 2026-09-14 |
| CVE-2026-75167 | medium | 4.3 | No | A broken access control vulnerability in the ugw-usr-edit method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 a... | 2026-09-14 |
| CVE-2026-73324 | medium | 4.3 | No | Certain VLC media player builds in versions 3.0.0 through 3.0.23 contain a memory-safety vulnerability reachable when processing media from... | 2026-09-14 |
| CVE-2026-62653 | medium | 6.8 | No | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The input received over a proprietary communication protocol th... | 2026-09-14 |
| CVE-2026-62647 | high | 7.4 | No | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A random number generator is used to generate security-relevant... | 2026-09-14 |
| CVE-2026-71620 | high | 8.1 | No | File Upload vulnerability in Zhao-github ApiAdmin v.5.0.1 allows a remote attacker to execute arbitrary code via a crafted .php file | 2026-09-14 |
| CVE-2026-22591 | high | 7.5 | No | eprosima Fast DDS is a C++ implementation of the DDS (Data Distribution Service) standard of the OMG (Object Management Group). Prior to ver... | 2026-09-14 |
| CVE-2026-52307 | medium | 5.4 | No | An authenticated stored cross-site scripting (XSS) vulnerability in the Column Management component of ClassCMS 1CMS v5.6 allows attackers t... | 2026-09-14 |
| CVE-2026-34223 | high | 8.2 | No | A vulnerability has been identified in Desigo CC ClickOnce Client V6 (All versions), Desigo CC ClickOnce Client V7 (All versions), Desigo CC... | 2026-09-14 |
| CVE-2022-35497 | medium | 5.4 | No | In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via re... | 2026-09-14 |
| CVE-2026-48273 | critical | 9.9 | No | ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that could... | 2026-09-14 |
| CVE-2026-83948 | high | 8.0 | No | Improper neutralization of special elements used in a command ('command injection') in Microsoft Azure CLI allows an authorized attacker to... | 2026-09-14 |
| CVE-2026-87810 | medium | 5.3 | No | Siyuan before v3.8.2 contains an information disclosure vulnerability in the POST /api/search/fullTextSearchBlock endpoint that filters priv... | 2026-09-14 |
| CVE-2026-87795 | high | 8.2 | No | zstd-jni versions before 1.5.7-14 fail to validate offset and length parameters in the ZstdDictCompress constructor, allowing out-of-bounds... | 2026-09-14 |
| CVE-2026-87734 | high | 7.5 | No | An issue was discovered in the utcp package before 0.0.6 for OCaml. Out-of-order segment reassembly allows remote denial of service. | 2026-09-14 |
| CVE-2026-87656 | medium | 5.4 | No | Improper state validation in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrict... | 2026-09-14 |
| CVE-2026-87575 | medium | 5.4 | No | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass... | 2026-09-14 |