Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-98714 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeed... | 2026-10-26 |
| CVE-2026-98439 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: smb/server: cancel async requests when closing connection An async req... | 2026-10-26 |
| CVE-2026-98436 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are neve... | 2026-10-26 |
| CVE-2026-98428 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs e... | 2026-10-26 |
| CVE-2026-98389 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip gfx switch_power_profile during GPU reset During resu... | 2026-10-26 |
| CVE-2023-7356 | high | 8.8 | No | In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches EIR_BAA_SERVICE_UUID... | 2026-10-26 |
| CVE-2026-12345 | not reported | — | No | The cleanup of tempfile.TemporaryDirectory is vulnerable to a race condition. An attacker who can modify the tree during cleanup can replace... | 2026-10-26 |
| CVE-2026-55203 | critical | 9.1 | No | HAProxy through 3.4.0, fixed in commit 5985276, contains an integer overflow vulnerability in the fcgi_conn structure's drl field that allow... | 2026-10-26 |
| CVE-2026-49268 | critical | 9.1 | No | A remote attacker can inject LDAP special characters into the Distinguished Name (DN) construction in DefaultLdapRealm class. User-supplied... | 2026-10-26 |
| CVE-2026-5787 | critical | 9.1 | No | An Improper Certificate Validation in Ivanti EPMM before versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 allows a remote unauthenticated attacker... | 2026-10-26 |
| CVE-2026-22619 | critical | 9.9 | No | Eaton Intelligent Power Protector (IPP) is affected by insecure library loading in its executable, which could lead to arbitrary code execut... | 2026-10-26 |
| CVE-2026-25208 | critical | 9.8 | No | Integer overflow vulnerability in Samsung Open Source Escargot allows Overflow Buffers.This issue affects Escargot: 97e8115ab1110bc502b4b5e4... | 2026-10-26 |
| CVE-2026-34727 | critical | 9.1 | No | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without ch... | 2026-10-26 |
| CVE-2026-5973 | critical | 9.8 | No | A vulnerability was found in FoundationAgents MetaGPT up to 0.8.1. Impacted is the function get_mime_type of the file metagpt/utils/common.p... | 2026-10-26 |
| CVE-2026-5663 | critical | 9.8 | No | A security flaw has been discovered in OFFIS DCMTK up to 3.7.0. This impacts the function executeOnReception/executeOnEndOfStudy of the file... | 2026-10-26 |
| CVE-2026-34568 | critical | 9.0 | No | CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support... | 2026-10-26 |
| CVE-2026-33943 | critical | 9.8 | No | Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. In versions 15.10.0 through 20.8.7, a code i... | 2026-10-26 |
| CVE-2026-8666 | critical | 9.8 | No | OS Command Injection vulnerability in the traceroute action of Rapid7 InsightConnect Traceroute Plugin on Linux allows remote attackers to e... | 2026-10-25 |
| CVE-2026-8665 | critical | 9.8 | No | OS Command Injection vulnerability in the TR action of Rapid7 InsightConnect Translate Plugin on Linux allows remote attackers to execute ar... | 2026-10-25 |
| CVE-2026-8660 | critical | 9.8 | No | OS Command Injection vulnerability in the ping action of Rapid7 InsightConnect Ping Plugin on Linux allows remote attackers to execute arbit... | 2026-10-25 |