Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83787 | medium | 5.5 | No | Insufficient verification of data authenticity in Windows DHCP Server allows an authorized attacker to bypass a security feature locally. | 2026-10-29 |
| CVE-2026-83788 | medium | 4.6 | No | Buffer over-read in Windows RNDIS allows an unauthorized attacker to disclose information with a physical attack. | 2026-10-29 |
| CVE-2026-78674 | high | 8.8 | No | The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted requests that can le... | 2026-10-29 |
| CVE-2026-6647 | high | 7.4 | No | In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for identity data, mismat... | 2026-10-29 |
| CVE-2026-3583 | low | 3.1 | No | When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately invalidate a token in the... | 2026-10-29 |
| CVE-2026-11854 | medium | 6.1 | No | The authentication endpoint generates an error message that includes reflected data directly from the request without sufficient sanitizatio... | 2026-10-29 |
| CVE-2026-5702 | not reported | — | No | Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clickin... | 2026-10-29 |
| CVE-2026-5700 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5699 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5698 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-5697 | not reported | — | No | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user... | 2026-10-29 |
| CVE-2026-7190 | not reported | — | No | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnerability is found in t... | 2026-10-29 |
| CVE-2026-113697 | not reported | — | No | Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticated attackers to execu... | 2026-10-29 |
| CVE-2026-113696 | not reported | — | No | Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allo... | 2026-10-29 |
| CVE-2026-113695 | not reported | — | No | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01,... | 2026-10-29 |
| CVE-2026-113694 | not reported | — | No | Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allo... | 2026-10-29 |
| CVE-2026-113693 | not reported | — | No | Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 2... | 2026-10-29 |
| CVE-2026-113692 | not reported | — | No | Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allows authe... | 2026-10-29 |
| CVE-2026-113691 | not reported | — | No | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.... | 2026-10-29 |
| CVE-2026-113690 | not reported | — | No | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01 allo... | 2026-10-29 |