Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91550 | high | 8.8 | No | Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Product Quality Manage... | 2026-10-26 |
| CVE-2026-91547 | medium | 5.5 | No | Vulnerability in Oracle GoldenGate (component: Vendor Access Module). Supported versions that are affected are 19.1.0.0.0-19.32.0.0, 21.3-21... | 2026-10-26 |
| CVE-2026-91530 | medium | 4.4 | No | Vulnerability in Oracle GoldenGate (component: Admin Client Executable). Supported versions that are affected are 23.4-23.26.2.0.0. Difficul... | 2026-10-26 |
| CVE-2026-91528 | medium | 4.3 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). The supported version that is affect... | 2026-10-26 |
| CVE-2026-77216 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-26 |
| CVE-2026-77215 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-26 |
| CVE-2026-109556 | high | 8.0 | No | EdgeEver Desktop 1.92.0 through 1.112.0 contains a remote code execution vulnerability in the desktop:acp-probe IPC handler, which lacks a s... | 2026-10-26 |
| CVE-2026-109427 | medium | 6.5 | No | Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access... | 2026-10-26 |
| CVE-2026-109376 | medium | 4.3 | No | ERPNext 15.55.0 through 16.50.0 contains an incorrect authorization vulnerability in the get_timesheet_html method that lets authenticated p... | 2026-10-26 |
| CVE-2026-109422 | high | 8.1 | No | NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a remote code execution vulnerability in... | 2026-10-26 |
| CVE-2026-109366 | low | 3.7 | No | Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated p... | 2026-10-26 |
| CVE-2026-109361 | high | 7.3 | No | MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path re... | 2026-10-26 |
| CVE-2026-41586 | critical | 9.8 | No | Hyperledger Fabric is an enterprise-grade permissioned distributed ledger framework for developing solutions and applications. From versions... | 2026-10-26 |
| CVE-2026-44603 | critical | 9.1 | No | Tor before 0.4.9.7 has an out-of-bounds read by one byte via a malformed BEGIN cell, aka TROVE-2026-007. | 2026-10-26 |
| CVE-2026-42994 | critical | 9.8 | No | Bitwarden CLI 2026.4.0 from 2026-04-22T21:57Z to 2026-04-22T23:30Z, when obtained from npm, had embedded malicious code. This is related to... | 2026-10-26 |
| CVE-2026-2311 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, 7.3, and 7.2 s vulnerable to privilege escalation caused by an invalid IBM i Web Administration GUI authorization check... | 2026-10-26 |
| CVE-2026-33447 | critical | 9.8 | No | CVE-2026-33447 is a buffer overflow in a message parsing function of the Secure Access client prior to 14.50. Attackers with control of a... | 2026-10-26 |
| CVE-2026-42799 | critical | 9.8 | No | Out-of-bounds read vulnerability in ASR Kestrel (nr_fw modules) allows Overflow Buffers. This vulnerability is associated with program file... | 2026-10-26 |
| CVE-2026-22070 | critical | 9.8 | No | ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal. | 2026-10-26 |
| CVE-2026-7248 | critical | 9.4 | No | A vulnerability was found in D-Link DI-8100 16.07.26A1. This affects the function tgfile_htm of the file tgfile.htm of the component CGI End... | 2026-10-26 |