Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61745 | medium | 4.3 | No | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTr... | 2026-09-23 |
| CVE-2026-86056 | medium | 5.5 | No | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, the NPPM_SAVESESSION handler in PowerEditor/src/NppBigSwitch.cpp con... | 2026-09-23 |
| CVE-2026-85995 | high | 7.3 | No | Notepad++ is a free and open-source source code editor. From 8.9.7 until 8.9.8, the Notepad++ updater and signature verification path can ac... | 2026-09-23 |
| CVE-2026-85279 | high | 8.6 | No | Notepad++ is a free and open-source source code editor. Prior to 8.9.8, Notepad++ contains a stack buffer overflow in PluginsManager::loadPl... | 2026-09-23 |
| CVE-2026-83597 | high | 7.0 | No | Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and... | 2026-09-23 |
| CVE-2026-83603 | high | 8.4 | No | Netdata is an open source observability tool. Prior to 2.10.4, the setuid-root ndsudo helper command fail2ban-client-status-socket in src/co... | 2026-09-23 |
| CVE-2026-83600 | medium | 6.5 | No | Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2... | 2026-09-23 |
| CVE-2026-83599 | high | 7.5 | No | Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate befo... | 2026-09-23 |
| CVE-2026-83598 | high | 7.8 | No | Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as S... | 2026-09-23 |
| CVE-2026-76805 | medium | 5.3 | No | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the DAST/fuzz payload path in pkg/fuzz/parts.go... | 2026-09-23 |
| CVE-2026-61820 | high | 8.5 | No | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherit_template_properties() manually s... | 2026-09-23 |
| CVE-2026-61722 | medium | 6.8 | No | FluidSynth is a software synthesizer based on the SoundFont 2 specifications. From 2.5.0 until 2.5.6, the native DLS parser validates articu... | 2026-09-23 |
| CVE-2026-10853 | high | 8.8 | No | IBM MQ could allow an authenticated attacker with cluster access to cause a denial of service or potentially execute arbitrary code due to i... | 2026-09-23 |
| CVE-2026-48976 | high | 8.1 | No | HomeBox is a home inventory and organization system. Prior to 0.26.0, NotifierRepository.Update in backend/internal/data/repo/repo_notifier.... | 2026-09-23 |
| CVE-2026-48975 | high | 8.1 | No | HomeBox is a home inventory and organization system. Prior to 0.26.0, MaintenanceEntryRepository.Update and MaintenanceEntryRepository.Delet... | 2026-09-23 |
| CVE-2026-48826 | high | 8.1 | No | HomeBox is a home inventory and organization system. Prior to 0.26.0, HandleWipeInventory in backend/app/api/handlers/v1/v1_ctrl_actions.go... | 2026-09-23 |
| CVE-2026-63373 | medium | 4.2 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, the OAuth callback handler in src/main/java/co... | 2026-09-23 |
| CVE-2026-63334 | medium | 6.8 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to version 30.2.7, deployments with ENABLE_DRAWIO_PROXY=1 are vul... | 2026-09-23 |
| CVE-2026-84298 | low | 3.1 | No | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask str... | 2026-09-23 |
| CVE-2026-61628 | high | 8.1 | No | nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, `POST /api/users/onboarding/finish` is registered as a... | 2026-09-23 |