Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-18449 | high | 7.5 | No | The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that ex... | 2026-10-27 |
| CVE-2026-16521 | high | 7.2 | No | An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC fu... | 2026-10-27 |
| CVE-2026-109453 | high | 7.0 | No | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 2026-10-27 |
| CVE-2026-91768 | medium | 6.5 | No | The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowed_clients mat... | 2026-10-27 |
| CVE-2026-69577 | high | 7.5 | No | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose... | 2026-10-27 |
| CVE-2026-69789 | high | 7.5 | No | Heap-based buffer overflow in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over an adjacent... | 2026-10-27 |
| CVE-2026-92842 | medium | 5.9 | No | The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars opti... | 2026-10-27 |
| CVE-2026-100749 | medium | 4.3 | No | Joomla Extension - svenbluege.de - CSRF in backend cleanup actions in Event Gallery extension < 6.5.0 - Only orphaned file entries and shopp... | 2026-10-27 |
| CVE-2026-16513 | high | 7.8 | No | The userspace verifier z_vrfy_rtio_sqe_copy_in_get_handles() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0) vali... | 2026-10-27 |
| CVE-2026-69802 | high | 8.1 | No | Weak authentication in Network Device Enrollment Service (NDES) allows an unauthorized attacker to execute code over a network. | 2026-10-27 |
| CVE-2026-18413 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-10-27 |
| CVE-2026-18414 | high | 7.8 | No | The ADC API requires each driver to reject a sampling sequence whose destination buffer is too small: the buffer_size field of struct adc_se... | 2026-10-27 |
| CVE-2026-83398 | high | 8.2 | No | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported versions that are af... | 2026-10-27 |
| CVE-2026-28167 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path... | 2026-10-27 |
| CVE-2026-116826 | medium | 6.8 | No | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated ad... | 2026-10-27 |
| CVE-2026-116822 | medium | 5.3 | No | YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary t... | 2026-10-27 |
| CVE-2026-116818 | high | 8.2 | No | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through... | 2026-10-27 |
| CVE-2026-116813 | medium | 6.5 | No | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share... | 2026-10-27 |
| CVE-2026-116809 | medium | 5.3 | No | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers... | 2026-10-27 |
| CVE-2026-116805 | medium | 4.3 | No | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of... | 2026-10-27 |