Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101581 | medium | 6.5 | No | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-dns-resolver-round-robin). Supported versions... | 2026-10-22 |
| CVE-2026-101572 | high | 7.5 | No | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-webclient-http2). Supported versions that are affected... | 2026-10-22 |
| CVE-2026-101569 | medium | 6.5 | No | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: helidon-common-concurrency-limits). Supported versions that are... | 2026-10-22 |
| CVE-2026-101520 | high | 7.5 | No | Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Instal... | 2026-10-22 |
| CVE-2026-101399 | medium | 5.3 | No | Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions that are affected are 1... | 2026-10-22 |
| CVE-2026-101359 | medium | 5.3 | No | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vul... | 2026-10-22 |
| CVE-2026-96912 | high | 7.8 | No | Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally. | 2026-10-22 |
| CVE-2026-96911 | high | 7.8 | No | Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevat... | 2026-10-22 |
| CVE-2026-96914 | high | 8.8 | No | Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges lo... | 2026-10-22 |
| CVE-2026-96913 | high | 7.8 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-10-22 |
| CVE-2026-83661 | high | 7.8 | No | Photoshop Desktop is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the contex... | 2026-10-22 |
| CVE-2026-93909 | critical | 9.1 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 is vulnerable by an authentication bypass vulnerability when samlWeb-2... | 2026-10-22 |
| CVE-2026-93905 | high | 8.2 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 could allow an unauthenticated remote attacker to corrupt the persiste... | 2026-10-22 |
| CVE-2026-93895 | critical | 9.1 | No | IBM WebSphere Application Server - Liberty 20.0.0.12 through 26.0.0.10 could allow an unauthenticated remote attacker to bypass access contr... | 2026-10-22 |
| CVE-2026-106462 | medium | 6.4 | No | Backstage is an open framework for building developer portals. Prior to 1.54.6, scaffolder source-control actions may not consistently enfor... | 2026-10-22 |
| CVE-2026-106463 | medium | 5.4 | No | Backstage is an open framework for building developer portals. Prior to 0.8.7, the @backstage/plugin-catalog-backend-module-gitlab package i... | 2026-10-22 |
| CVE-2026-106487 | medium | 5.0 | No | Backstage is an open framework for building developer portals. Prior to 0.21.10, the @backstage/plugin-kubernetes-backend package is affecte... | 2026-10-22 |
| CVE-2026-87942 | medium | 4.6 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete allows Stored XSS. T... | 2026-10-22 |
| CVE-2026-87940 | medium | 5.4 | No | Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting Incorrectly Configured Access C... | 2026-10-22 |
| CVE-2026-87939 | medium | 4.2 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block allows Stored XSS. T... | 2026-10-22 |