Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80225 | high | 7.5 | No | In NLnetLabs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where th... | 2026-09-23 |
| CVE-2026-81349 | high | 7.2 | No | Improper neutralization of special elements used in an os command ('os command injection') in Azure HDInsights allows an authorized attacker... | 2026-09-23 |
| CVE-2026-81380 | medium | 5.9 | No | Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unaut... | 2026-09-23 |
| CVE-2026-81634 | high | 7.5 | No | In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow durin... | 2026-09-23 |
| CVE-2026-82717 | critical | 9.8 | No | In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found in that can progressively corrupt heap memory and under certain... | 2026-09-23 |
| CVE-2026-82720 | medium | 5.9 | No | NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPs support with '--wit... | 2026-09-23 |
| CVE-2026-83998 | high | 8.8 | No | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-09-23 |
| CVE-2026-54648 | medium | 6.5 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PER... | 2026-09-23 |
| CVE-2026-54646 | high | 7.2 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablenam... | 2026-09-23 |
| CVE-2026-54643 | medium | 5.4 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the... | 2026-09-23 |
| CVE-2026-54608 | not reported | — | No | MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.ph... | 2026-09-23 |
| CVE-2026-28663 | high | 7.8 | No | In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass... | 2026-09-23 |
| CVE-2026-19202 | not reported | — | No | A caching flaw in the toolbox-core package of the mcp-toolbox-sdk-python SDK causes the same Google ID token to be cached and reused across... | 2026-09-23 |
| CVE-2026-91018 | high | 8.8 | No | lwIP (Lightweight IP) has a double free vulnerability, which could crash the system, cause a DoS, memory corruption, or allow code execution... | 2026-09-23 |
| CVE-2026-88020 | medium | 6.1 | No | Autonomy Logic OpenPLC 3 is susceptible to an improper neutralization of input during web page generation vulnerability when the web interfa... | 2026-09-23 |
| CVE-2026-87121 | critical | 9.8 | No | lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device. | 2026-09-23 |
| CVE-2026-96456 | medium | 6.3 | No | The Reachy Mini Bluetooth service asks a connecting device for a PIN before it will accept commands. The check protects the session but not... | 2026-09-23 |
| CVE-2026-96455 | high | 8.8 | No | The Reachy Mini daemon exposes an HTTP API for managing the robot. Its app installation endpoint, POST /apps/install in src/reachy_mini/daem... | 2026-09-23 |
| CVE-2026-96454 | high | 8.2 | No | Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream templ... | 2026-09-23 |
| CVE-2026-95627 | high | 7.7 | No | When a Tauri application uses the dialog plugin's file or folder picker, an attacker with JavaScript execution (XSS) can force the scope exp... | 2026-09-23 |