Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-17443 | medium | 6.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-85978 | critical | 9.8 | No | An unauthenticated remote code execution vulnerability exists in the Policy Manager console of Akana API Platform. A path normalization disc... | 2026-09-09 |
| CVE-2026-87737 | medium | 5.9 | No | An issue was discovered in the mirage-crypto-ec package before 2.4.0 for OCaml. There is a timing side channel for NIST elliptic-curve scala... | 2026-09-09 |
| CVE-2026-87733 | medium | 6.2 | No | An issue was discovered in the mirage-crypto-ec function before 2.2.0 for OCaml. The ECDSA functions {P256,P384,P521}.Dsa.pub_of_octets acce... | 2026-09-09 |
| CVE-2026-87732 | medium | 6.2 | No | An issue was discovered in the mirage-crypto package before 2.2.0 for OCaml. The AES.GCM.authenticate_decrypt_into and Chacha20.authenticate... | 2026-09-09 |
| CVE-2026-78741 | medium | 6.1 | No | Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) in the wysiwyg-CKEditor image upload feature. | 2026-09-09 |
| CVE-2026-78834 | high | 8.8 | No | A code execution vulnerability exists in CMSimple 5.22 in the CoAuthors plugin. An authenticated low-privileged user who can modify page con... | 2026-09-09 |
| CVE-2026-79569 | critical | 9.8 | No | Movie_Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability all... | 2026-09-09 |
| CVE-2026-79576 | critical | 9.8 | No | An issue in the Single-Sign On (SSO) component of Digital-Infrastructure v9.6.7 allows attackers to authenticate as any user, including the... | 2026-09-09 |
| CVE-2026-79575 | high | 7.5 | No | The JWT signing secret in yfexam-exam v2.0 is derived from the username and the current month instead of a random server-side key, making th... | 2026-09-09 |
| CVE-2026-79378 | high | 7.5 | No | An issue in the btm_acl_handle() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers to c... | 2026-09-09 |
| CVE-2026-79377 | high | 7.5 | No | A heap overflow in the a2dp_decoder_sbc.cpp component of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows at... | 2026-09-09 |
| CVE-2026-79376 | high | 8.8 | No | An issue in the l2cap_handle_data() function of Bestechnic Co., Ltd BES2300 Bluetooth Audio SoC firmware v3.x and earlier allows attackers t... | 2026-09-09 |
| CVE-2026-16876 | not reported | — | No | An authentication bypass vulnerability exists in the WebGUI of Series UNIVERGE IX-R/IX-V. A user could bypass authentication and execute arb... | 2026-09-09 |
| CVE-2026-86145 | high | 8.2 | No | PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching works... | 2026-09-09 |
| CVE-2026-79426 | high | 7.2 | No | An arbitrary file deletion vulnerability in the /adminapi/file/video_data_save component of CRMEB v6.0.0 allows authenticated attackers to d... | 2026-09-09 |
| CVE-2026-79423 | high | 8.8 | No | An authenticated remote code execution (RCE) vulnerability in the admin_config.php component of seacms v13.6 allows attackers to execute arb... | 2026-09-09 |
| CVE-2026-75438 | high | 7.5 | No | Buffer Overflow vulnerability in Open5GS v2.7.7 allows a remote attacker to cause a denial of service via the ogs_sbi_time_parse() function | 2026-09-09 |
| CVE-2026-79391 | critical | 9.8 | No | No authentication exists in the MQTT service of Trueview 6.0.23.4. The MQTT broker accepts client connections on TCP port 1883 without requi... | 2026-09-09 |
| CVE-2026-71626 | high | 7.5 | No | An issue in Invoice Ninja v5.13.24 allows a remote attacker to obtain sensitive information via the StoreWebhookRequest.php, UpdateWebhookRe... | 2026-09-09 |