Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96618 | not reported | — | No | Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in hexpm hex allows an untrusted package mirror to exhaust th... | 2026-10-16 |
| CVE-2026-96612 | not reported | — | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in hexpm hex allows a malicious package publish... | 2026-10-16 |
| CVE-2026-69931 | high | 7.0 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker... | 2026-10-16 |
| CVE-2026-92876 | high | 7.5 | No | IBM Maximo Application Suite - IoT Component 9.2.0, 9.1.0, and 9.0.0 could allow a remote attacker to cause a denial of service due to uncon... | 2026-10-16 |
| CVE-2026-92877 | not reported | — | No | The JAXB factory methods historically relied solely on `FEATURE_SECURE_PROCESSING` to prevent XML External Entity (XXE) resolution. On JAXP... | 2026-10-16 |
| CVE-2026-92120 | critical | 9.1 | No | OAuth1 Request Replay Attack vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to up... | 2026-10-16 |
| CVE-2026-92119 | critical | 9.1 | No | REST API Mass Assignment vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgrad... | 2026-10-16 |
| CVE-2026-92116 | critical | 9.1 | No | OAuth1 callback validation vulnerability in Apache Allura. This issue affects Apache Allura: through 1.21.0. Users are recommended to upgr... | 2026-10-16 |
| CVE-2026-91142 | low | 3.6 | No | A flaw was found in Cockpit. An authenticated local user with a large user identifier (UID) can cause unauthorized modification and disclosu... | 2026-10-16 |
| CVE-2026-89079 | critical | 9.8 | No | The Theme My Login plugin for WordPress is vulnerable to privilege escalation via account takeover in versions up to, and including, 7.2.1.... | 2026-10-16 |
| CVE-2026-89202 | medium | 6.5 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly perform authorization chec... | 2026-10-16 |
| CVE-2026-89197 | high | 8.8 | No | A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V6.0). Affected devices do not properly validate or sanitize input... | 2026-10-16 |
| CVE-2026-85976 | medium | 5.4 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 do not sufficiently sanitize input used by the Query C... | 2026-10-16 |
| CVE-2026-85957 | high | 7.5 | No | Affected Progress MarkLogic Server 11.x releases before 11.3.7 use a SAML parser configuration that can process external DTDs or entities, w... | 2026-10-16 |
| CVE-2026-85949 | high | 8.1 | No | Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 may record security-sensitive information in diagnosti... | 2026-10-16 |
| CVE-2026-85499 | critical | 9.1 | No | Improper Authorization vulnerability in Apache SkyWalking BanyanDB. The Canopy includes incomplete proof-of-concept role and monitoring-pro... | 2026-10-16 |
| CVE-2026-69926 | high | 7.8 | No | Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges... | 2026-10-16 |
| CVE-2026-79715 | medium | 5.5 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 could allow a local attacker to traverse directories on the system. An... | 2026-10-16 |
| CVE-2026-78556 | high | 7.4 | No | A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9). The affected software does not properly valid... | 2026-10-16 |
| CVE-2026-81856 | not reported | — | No | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in hexpm hex allows a malicious package publisher or a hostile r... | 2026-10-16 |