Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-49881 | high | 7.8 | No | In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could le... | 2026-09-23 |
| CVE-2026-49882 | high | 8.8 | No | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code... | 2026-09-23 |
| CVE-2026-49884 | high | 7.8 | No | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es... | 2026-09-23 |
| CVE-2026-96758 | critical | 9.8 | No | orval @orval/core before 8.28.0 contains a code injection vulnerability in the form-data serializer that fails to escape multipart property... | 2026-09-23 |
| CVE-2026-96513 | high | 7.3 | No | A security flaw has been discovered in Neethuharii CafeManagement. This issue affects some unknown processing of the file AddProductCode.php... | 2026-09-23 |
| CVE-2026-93970 | high | 7.3 | No | A security flaw has been discovered in aiyiyi121 SxDevOps 1.0/1.1. This issue affects some unknown processing of the file backend/sxdevops/s... | 2026-09-23 |
| CVE-2026-93368 | high | 7.5 | No | The Rename wp-login.php to anything you want plugin for WordPress is vulnerable to time-based SQL Injection via 'log' (Username) Parameter i... | 2026-09-23 |
| CVE-2026-93337 | high | 7.8 | No | NetworkManager-l2tp through 1.52.4, fixed in 1.52.6, contains an improper input validation vulnerability that allows local users with VPN co... | 2026-09-23 |
| CVE-2026-92764 | medium | 4.3 | No | OpenCVE versions 2.4.0 before 3.1.0 fails to properly scope the organizations API endpoint to the token's organization, instead returning th... | 2026-09-23 |
| CVE-2026-91092 | medium | 4.3 | No | The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the... | 2026-09-23 |
| CVE-2026-87022 | high | 7.5 | No | Improper handling of length parameter inconsistency vulnerability in Apache Tomcat allows WebSocket message smuggling when per-message-defla... | 2026-09-23 |
| CVE-2026-89412 | high | 7.2 | No | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via... | 2026-09-23 |
| CVE-2026-79677 | high | 7.5 | No | Missing release of resource after effective lifetime, Comparison using wrong factors vulnerability in Apache Tomcat allows a denial of servi... | 2026-09-23 |
| CVE-2026-78437 | high | 7.3 | No | Incomplete cleanup vulnerability in Apache Tomcat allows a malformed request to potentially (depends on timing) cause one request from anoth... | 2026-09-23 |
| CVE-2026-78383 | high | 7.5 | No | Allocation of resources without limits or throttling vulnerability in Apache Tomcat allows an unauthenticated AJP request to pin an AJP proc... | 2026-09-23 |
| CVE-2026-77791 | high | 7.5 | No | Uncontrolled Resource Consumption vulnerability in Apache Tomcat during sending of WebSocket close message enabled a DoS attack. This issue... | 2026-09-23 |
| CVE-2026-77756 | low | 3.7 | No | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in Apache Tomcat caused by processing the tra... | 2026-09-23 |
| CVE-2026-75973 | high | 7.3 | No | Improper Authentication vulnerability in Apache Tomcat. When Jakarta Authentication was configured with SimpleAuthConfigProvider as the defa... | 2026-09-23 |
| CVE-2026-69443 | high | 7.5 | No | Out-of-bounds read in Microsoft Azure Attestation service and Device Health Attestation Service allows an unauthorized attacker to disclose... | 2026-09-23 |
| CVE-2026-55456 | not reported | — | No | Rejected reason: This CVE is a duplicate of another CVE. | 2026-09-23 |