Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19649 | medium | 5.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-78543 | high | 7.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-16180 | medium | 5.7 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-17274 | medium | 5.4 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to bypass security restrictions due to predictable server seeds. | 2026-09-09 |
| CVE-2026-86256 | medium | 5.4 | No | wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). Af... | 2026-09-09 |
| CVE-2026-86251 | medium | 5.9 | No | h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path co... | 2026-09-09 |
| CVE-2026-86210 | high | 7.3 | No | A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unk... | 2026-09-09 |
| CVE-2026-86181 | low | 3.5 | No | A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /use... | 2026-09-09 |
| CVE-2026-86170 | medium | 6.3 | No | A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php... | 2026-09-09 |
| CVE-2026-76961 | low | 3.5 | No | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due... | 2026-09-09 |
| CVE-2026-17440 | medium | 5.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-18851 | high | 8.8 | No | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attac... | 2026-09-09 |
| CVE-2026-86733 | high | 7.2 | No | Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) wi... | 2026-09-09 |
| CVE-2026-76196 | high | 7.4 | No | Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this... | 2026-09-09 |
| CVE-2026-79904 | medium | 5.0 | No | Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could r... | 2026-09-09 |
| CVE-2026-77109 | high | 8.6 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage... | 2026-09-09 |
| CVE-2026-76201 | critical | 9.3 | No | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri... | 2026-09-09 |
| CVE-2026-76200 | critical | 9.3 | No | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri... | 2026-09-09 |
| CVE-2026-77774 | high | 8.6 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev... | 2026-09-09 |
| CVE-2026-86735 | medium | 5.0 | No | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect I... | 2026-09-09 |