Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-14297 | not reported | — | No | A buffer overflow in the Bluetooth Continuous Glucose Monitoring Service (CGMS) Record Access Control Point (RACP) write handler allows an... | 2026-09-09 |
| CVE-2026-14296 | high | 7.5 | No | When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active sl... | 2026-09-09 |
| CVE-2026-19614 | not reported | — | No | The API is prone to XML external entity (XXE) injection. By default, XML external entity support is enabled. This issue affects NanoXML: 2.2... | 2026-09-09 |
| CVE-2026-86564 | low | 3.3 | No | A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause... | 2026-09-09 |
| CVE-2026-18058 | high | 7.5 | No | The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation c... | 2026-09-09 |
| CVE-2026-14957 | high | 7.5 | No | In FIPS mode, Libreswan's add_decoded_cert() function calls CERT_ExtractPublicKey() and asserts that the result is not NULL. However, CERT_E... | 2026-09-09 |
| CVE-2026-86242 | high | 8.1 | No | Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins whe... | 2026-09-09 |
| CVE-2026-19651 | high | 7.4 | No | IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipula... | 2026-09-09 |
| CVE-2026-17499 | high | 7.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements u... | 2026-09-09 |
| CVE-2026-79721 | not reported | — | No | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to... | 2026-09-09 |
| CVE-2026-67402 | not reported | — | No | An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho... | 2026-09-09 |
| CVE-2026-79989 | not reported | — | No | The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elev... | 2026-09-09 |
| CVE-2026-67395 | medium | 5.9 | No | A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path para... | 2026-09-09 |
| CVE-2026-12858 | not reported | — | No | Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC. | 2026-09-09 |
| CVE-2026-87827 | not reported | — | No | Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring... | 2026-09-09 |
| CVE-2026-78377 | medium | 6.1 | No | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Syst... | 2026-09-09 |
| CVE-2026-19733 | medium | 5.3 | No | Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and... | 2026-09-09 |
| CVE-2026-11838 | medium | 4.3 | No | Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind... | 2026-09-09 |
| CVE-2026-76801 | high | 8.8 | No | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code... | 2026-09-09 |
| CVE-2026-13709 | medium | 6.4 | No | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_tem... | 2026-09-09 |