Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93008 | medium | 6.8 | No | A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking... | 2026-10-29 |
| CVE-2026-94109 | high | 8.0 | No | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.rende... | 2026-10-29 |
| CVE-2026-93006 | medium | 6.8 | No | A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated whe... | 2026-10-29 |
| CVE-2026-90458 | medium | 5.4 | No | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. | 2026-10-29 |
| CVE-2026-91476 | medium | 5.3 | No | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported v... | 2026-10-29 |
| CVE-2026-91400 | low | 3.1 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).... | 2026-10-29 |
| CVE-2026-85498 | low | 3.5 | No | A flaw was found in polkit. When processing input that begins with a null byte, an arithmetic error in the authentication agent helper cause... | 2026-10-29 |
| CVE-2026-86925 | medium | 5.5 | No | An authorization issue was addressed with improved state management. This issue is fixed in iOS 27.2 and iPadOS 27.2, macOS Golden Gate 27.2... | 2026-10-29 |
| CVE-2026-86055 | not reported | — | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.13.3, Part-DB builds the absolute URL of... | 2026-10-29 |
| CVE-2026-87373 | medium | 6.5 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-10-29 |
| CVE-2026-87352 | medium | 4.4 | No | Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: LDAP). Supported versions that are affected... | 2026-10-29 |
| CVE-2026-87302 | critical | 9.1 | No | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are... | 2026-10-29 |
| CVE-2026-88648 | low | 3.7 | No | Incomplete X.509 implementation in GnuTLS v3.8.13 allows attackers controlling a subordinate Certificate Authority to bypass cross-domain PK... | 2026-10-29 |
| CVE-2026-56834 | high | 7.5 | No | PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes... | 2026-10-29 |
| CVE-2026-59188 | medium | 5.4 | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.3, Part-DB-server sanitizes SVG files... | 2026-10-29 |
| CVE-2026-54630 | critical | 9.6 | No | Part-DB is an open source inventory management system for electronic components. Prior to version 2.12.1, the part attachment upload handler... | 2026-10-29 |
| CVE-2026-67615 | high | 8.8 | No | openEQUELLA before 2026.1.0 contains an authenticated remote code execution vulnerability that allows any authenticated non-guest user to ex... | 2026-10-29 |
| CVE-2026-52356 | high | 8.8 | No | An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04 allows attackers to execut... | 2026-10-29 |
| CVE-2026-43840 | not reported | — | No | A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to crash the service via the... | 2026-10-29 |
| CVE-2026-42693 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TieLabs Jannah jannah allows Reflected... | 2026-10-29 |