Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84650 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to... | 2026-09-11 |
| CVE-2026-84646 | medium | 4.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all... | 2026-09-11 |
| CVE-2026-84645 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi... | 2026-09-11 |
| CVE-2026-84648 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta... | 2026-09-11 |
| CVE-2026-70334 | high | 7.8 | No | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 2026-09-11 |
| CVE-2026-78461 | high | 7.4 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypa... | 2026-09-11 |
| CVE-2026-78462 | high | 8.8 | No | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a n... | 2026-09-11 |
| CVE-2026-81356 | high | 8.2 | No | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to by... | 2026-09-11 |
| CVE-2026-81357 | high | 8.2 | No | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-81376 | critical | 9.6 | No | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network... | 2026-09-11 |
| CVE-2026-81377 | medium | 6.5 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perf... | 2026-09-11 |
| CVE-2026-84652 | high | 7.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me... | 2026-09-11 |
| CVE-2026-81378 | high | 8.2 | No | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-81379 | high | 8.2 | No | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-73310 | medium | 5.9 | No | XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect... | 2026-09-11 |
| CVE-2026-73309 | critical | 9.1 | No | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to... | 2026-09-11 |
| CVE-2026-73316 | high | 7.5 | No | XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same... | 2026-09-11 |
| CVE-2026-73315 | high | 8.6 | No | XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated at... | 2026-09-11 |
| CVE-2026-73314 | high | 7.5 | No | XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers... | 2026-09-11 |
| CVE-2026-73312 | high | 7.4 | No | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploit... | 2026-09-11 |