Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87103 | high | 7.4 | No | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Prote... | 2026-10-29 |
| CVE-2026-87102 | high | 7.4 | No | Sensitive information disclosure and manipulation due to improper token validation. The following products are affected: Acronis Cyber Prote... | 2026-10-29 |
| CVE-2026-86378 | high | 8.8 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-29 |
| CVE-2026-86384 | critical | 9.8 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-29 |
| CVE-2026-86379 | high | 7.2 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-10-29 |
| CVE-2026-85898 | high | 8.8 | No | Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute... | 2026-10-29 |
| CVE-2026-83393 | high | 8.5 | No | Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are aff... | 2026-10-29 |
| CVE-2026-83363 | high | 8.8 | No | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Suppor... | 2026-10-29 |
| CVE-2026-81472 | medium | 4.2 | No | Dell iDRAC Service Module (iSM) for Windows, Dell iDRAC Service Module (iSM) for Linux, and Dell iDRAC Service Module (iSM) for ESXi, versio... | 2026-10-29 |
| CVE-2026-83361 | high | 8.1 | No | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Suppor... | 2026-10-29 |
| CVE-2026-48379 | high | 7.8 | No | Substance3D - Painter is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the contex... | 2026-10-29 |
| CVE-2026-47486 | high | 7.8 | No | NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write. A successful exploit of this v... | 2026-10-29 |
| CVE-2026-50057 | high | 7.8 | No | A local privilege escalation vulnerability in the Zimbra Collaboration Suite (ZCS) MTA package allows the Unix zimbra account to execute arb... | 2026-10-29 |
| CVE-2026-50056 | high | 7.8 | No | A local privilege escalation vulnerability in the zmmailboxdmgr launcher of Zimbra Collaboration Suite (ZCS) allows the Unix zimbra account... | 2026-10-29 |
| CVE-2026-2270 | medium | 5.9 | No | A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write permissions on StatefulSet and... | 2026-10-29 |
| CVE-2026-116844 | medium | 4.8 | No | Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only the transferTLS flag... | 2026-10-29 |
| CVE-2026-115785 | medium | 4.3 | No | An SMTP command injection vulnerability in the data-source testing functionality of Zimbra Collaboration Suite (ZCS) allows an ordinary auth... | 2026-10-29 |
| CVE-2026-114732 | medium | 6.8 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations.... | 2026-10-29 |
| CVE-2026-113775 | high | 7.8 | No | A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk F... | 2026-10-29 |
| CVE-2026-111422 | high | 8.8 | No | In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, alt... | 2026-10-29 |