Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51974 | high | 8.8 | No | An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remo... | 2026-09-08 |
| CVE-2026-18221 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authent... | 2026-09-08 |
| CVE-2022-35499 | high | 7.1 | No | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary p... | 2026-09-08 |
| CVE-2026-18341 | high | 8.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow. | 2026-09-08 |
| CVE-2026-83557 | medium | 5.6 | No | DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly... | 2026-09-08 |
| CVE-2026-19032 | medium | 5.3 | No | jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStrin... | 2026-09-08 |
| CVE-2026-78230 | not reported | — | No | AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds... | 2026-09-08 |
| CVE-2026-78216 | not reported | — | No | AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg... | 2026-09-08 |
| CVE-2026-85458 | not reported | — | No | Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height. | 2026-09-08 |
| CVE-2026-79603 | medium | 4.3 | No | x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) wh... | 2026-09-08 |
| CVE-2026-6244 | medium | 5.5 | No | libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular unc... | 2026-09-08 |
| CVE-2026-31912 | medium | 5.5 | No | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a ju... | 2026-09-08 |
| CVE-2026-31911 | medium | 5.5 | No | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a craf... | 2026-09-08 |
| CVE-2026-18313 | medium | 4.3 | No | rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it... | 2026-09-08 |
| CVE-2026-18238 | medium | 5.0 | No | The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious serv... | 2026-09-08 |
| CVE-2026-0799 | high | 8.7 | No | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not... | 2026-09-08 |
| CVE-2026-19219 | high | 8.1 | No | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient integrity protection of dialog request parameters used by the RadEditor... | 2026-09-08 |
| CVE-2026-18672 | high | 7.5 | No | In Progress® Telerik® UI for AJAX prior to v2026.3.812, insufficient validation of client-supplied state in RadImageEditor may allow an atta... | 2026-09-08 |
| CVE-2026-86673 | high | 7.3 | No | A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issu... | 2026-09-08 |
| CVE-2026-86670 | low | 3.7 | No | A flaw has been found in aircheng-org iWebShop-5 up to 5.15. This impacts an unknown function of the file controllers/admin.php of the compo... | 2026-09-08 |