Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92774 | medium | 4.3 | No | Wiki.js through 2.5.314 omits page tags from authorization checks in multiple GraphQL resolvers, allowing tag-based access restrictions to b... | 2026-09-24 |
| CVE-2026-92763 | high | 8.1 | No | Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint.... | 2026-09-24 |
| CVE-2026-92719 | high | 7.5 | No | Quickwit through 0.9.0 fails to validate the host and scheme of the queue_url parameter in SQS file sources, allowing attackers to make the... | 2026-09-24 |
| CVE-2026-92716 | critical | 9.6 | No | Shuffle through 2.2.1 contains a cross-tenant privilege escalation vulnerability in the HandleApiGeneration endpoint that allows administrat... | 2026-09-24 |
| CVE-2026-91145 | high | 7.1 | No | Activiti through 7.1.0.M6 fails to validate hash-brace deferred expressions in process variables, allowing attackers to bypass expression fi... | 2026-09-24 |
| CVE-2026-90781 | medium | 4.4 | No | alsa-lib through 1.2.16.1 contains a stack buffer overflow in the __snd_ctl_ascii_elem_id_parse() function that writes one byte past a 64-by... | 2026-09-24 |
| CVE-2026-90776 | high | 7.5 | No | Nodemailer versions 9.1.0 through 10.0.4 contain a quadratic time complexity vulnerability in the addressparser component when parsing email... | 2026-09-24 |
| CVE-2026-94055 | medium | 5.3 | No | Exim before 4.100.1, when certain non-default TLS settings are used with GnuTLS, has a use-after-free. | 2026-09-24 |
| CVE-2026-94056 | high | 7.5 | No | Exim before 4.100.1, when Proxy-Protocol is used with an attacker-controlled proxy, allows attackers to read certain uninitialized data from... | 2026-09-24 |
| CVE-2026-56719 | medium | 6.5 | No | MikroTik RouterOS before 7.24 contains an out-of-bounds read vulnerability in the userspace SMB daemon that allows unauthenticated attackers... | 2026-09-24 |
| CVE-2026-89025 | high | 7.5 | No | Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of... | 2026-09-24 |
| CVE-2026-91197 | medium | 6.5 | No | Flowable flowable-engine through 8.0.0 contains an XML external entity injection vulnerability in ProcessDiagramLayoutFactory.parseXml() tha... | 2026-09-24 |
| CVE-2026-89020 | medium | 4.3 | No | MikroTik RouterOS before 7.23.4 (long-term) and 7.24.2 (stable) contains a stack-based buffer overflow vulnerability in the mtget binary's T... | 2026-09-24 |
| CVE-2026-82035 | high | 7.1 | No | PyMuPDF through 1.28.2, fixed in commit b2c8f3a, contains a path traversal vulnerability in the font branch of extract_objects() in src/__ma... | 2026-09-24 |
| CVE-2026-90930 | medium | 6.8 | No | File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the ta... | 2026-09-24 |
| CVE-2026-90929 | high | 8.1 | No | File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in... | 2026-09-24 |
| CVE-2026-90928 | medium | 6.5 | No | File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files... | 2026-09-24 |
| CVE-2026-90771 | low | 3.7 | No | joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __prot... | 2026-09-24 |
| CVE-2026-57842 | high | 7.0 | No | NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a... | 2026-09-24 |
| CVE-2026-89147 | high | 7.5 | No | Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated block... | 2026-09-24 |