Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87899 | not reported | — | No | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | 2026-09-24 |
| CVE-2026-87898 | not reported | — | No | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | 2026-09-24 |
| CVE-2026-68492 | not reported | — | No | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users... | 2026-09-24 |
| CVE-2026-68490 | not reported | — | No | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | 2026-09-24 |
| CVE-2026-88344 | high | 7.5 | No | An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with... | 2026-09-24 |
| CVE-2026-92706 | low | 3.4 | No | Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extens... | 2026-09-24 |
| CVE-2026-61674 | not reported | — | No | Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugin... | 2026-09-24 |
| CVE-2026-55563 | not reported | — | No | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_re... | 2026-09-24 |
| CVE-2026-53940 | high | 8.8 | No | Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_en... | 2026-09-24 |
| CVE-2026-55567 | high | 7.8 | No | BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a... | 2026-09-24 |
| CVE-2026-69184 | high | 7.5 | No | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not b... | 2026-09-24 |
| CVE-2026-77301 | high | 7.5 | No | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entr... | 2026-09-24 |
| CVE-2026-54633 | not reported | — | No | PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can c... | 2026-09-24 |
| CVE-2026-77281 | medium | 6.5 | No | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses aff... | 2026-09-24 |
| CVE-2026-50277 | high | 7.5 | No | dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without en... | 2026-09-24 |
| CVE-2026-54451 | not reported | — | No | Elixir protobuf is a pure Elixir implementation of Google Protobuf. From 0.8.0 until 0.16.1, services that decode attacker-controlled protob... | 2026-09-24 |
| CVE-2026-85720 | medium | 5.9 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2... | 2026-09-24 |
| CVE-2026-85716 | low | 3.7 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 3... | 2026-09-24 |
| CVE-2026-85719 | high | 7.5 | No | The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2... | 2026-09-24 |
| CVE-2026-82399 | high | 7.5 | No | CoreDNS is a DNS server written in Go. Prior to 1.14.7, the DNS-over-HTTPS, DNS-over-HTTP/3, DNS-over-QUIC, and DNS-over-gRPC request paths... | 2026-09-24 |