Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89102 | medium | 6.5 | No | In wolfSSL versions 5.7.2 through 5.9.2 there is a client-side implementation flaw in RFC 6961, multiple OCSP response stapling, which can l... | 2026-09-30 |
| CVE-2026-13720 | medium | 5.4 | No | An Editor can set file-provisioning metadata (the grafana.app/managedBy, grafana.app/managerId and grafana.app/sourcePath annotations) when... | 2026-09-30 |
| CVE-2026-13719 | medium | 4.3 | No | An authenticated user can list alert rules stored in folders they are not allowed to read through the alert rules API list endpoint. When th... | 2026-09-30 |
| CVE-2026-81842 | medium | 4.3 | No | An authenticated user with edit permission on one folder can move a library panel into another folder where they only have view permission,... | 2026-09-30 |
| CVE-2026-81841 | medium | 5.3 | No | Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the... | 2026-09-30 |
| CVE-2026-102875 | high | 7.8 | No | VLC media player before 3.0.24 contains a path traversal vulnerability in the skins2 ThemeLoader that fails to validate member names in .vlt... | 2026-09-30 |
| CVE-2026-102809 | medium | 6.5 | No | PX4 Autopilot through 1.17.0 contains an uncontrolled stack allocation vulnerability in the file2 test command that fails to validate the wr... | 2026-09-30 |
| CVE-2026-102567 | medium | 6.1 | No | CTranslate2 before 4.8.1 contains an out-of-bounds heap read vulnerability in the binary model loader when deserializing string fields witho... | 2026-09-30 |
| CVE-2026-102566 | high | 7.8 | No | CTranslate2 before 4.8.1 contains a heap-based buffer overflow in the binary model loader that fails to validate payload length against allo... | 2026-09-30 |
| CVE-2026-4034 | not reported | — | No | Injection Vulnerability in Tibco Administrator version 5.13.0 & prior allows an authenticated user to submit specially crafted input through... | 2026-09-30 |
| CVE-2026-101878 | high | 7.5 | No | Bitwarden Server 2025.6.0 before 2026.5.0 declares the @ExternalId parameter of the User_ReadBySsoUserOrganizationIdExternalId stored proced... | 2026-09-30 |
| CVE-2026-102297 | medium | 4.3 | No | ZoneMinder before 1.38.4 fails to apply per-monitor access restrictions in the FramesController index endpoint. Authenticated users with Eve... | 2026-09-30 |
| CVE-2026-102296 | medium | 6.5 | No | ZoneMinder before 1.38.4 contains static buffer overflow vulnerabilities in RemoteCameraHttp::GetResponse() that allow malicious HTTP camera... | 2026-09-30 |
| CVE-2024-58386 | medium | 6.5 | No | ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read ar... | 2026-09-30 |
| CVE-2026-93355 | high | 8.1 | No | LiteLLM contains a weak authentication vulnerability that allows an attacker holding a valid JWT from the configured identity provider to au... | 2026-09-30 |
| CVE-2026-12342 | critical | 9.6 | No | This vulnerability impacts all versions of IdentityIQ and allows an unauthenticated user remote code execution on the IdentityIQ server due... | 2026-09-30 |
| CVE-2026-101044 | high | 7.1 | No | pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate... | 2026-09-30 |
| CVE-2026-101043 | high | 7.4 | No | pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy,... | 2026-09-30 |
| CVE-2026-101042 | medium | 6.4 | No | Parse Server is an open-source backend server. In versions >= 9.0.0 < 9.10.1-alpha.10 and >= 8.0.2 < 8.6.91, the code-based authentication a... | 2026-09-30 |
| CVE-2026-100704 | high | 7.7 | No | Kyverno is a policy engine for Kubernetes. In versions 1.14.0 through 1.19.0, the ImageValidatingPolicy (policies.kyverno.io/v1beta1) evalua... | 2026-09-30 |