Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-45723 | low | 2.7 | No | Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. Prior to 1.6.6 and 1.7.3, managementServer.CreateSchematic in intern... | 2026-09-23 |
| CVE-2026-85999 | medium | 5.3 | No | Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4. Prior to 2.9, selector_iter in src/soupsieve/css_parser.py t... | 2026-09-23 |
| CVE-2026-75523 | medium | 5.9 | No | Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. Prior to 4.3.0,... | 2026-09-23 |
| CVE-2026-61700 | low | 3.7 | No | MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5... | 2026-09-23 |
| CVE-2026-64684 | medium | 6.8 | No | RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/s... | 2026-09-23 |
| CVE-2026-78560 | medium | 6.5 | No | The Okta Access Gateway includes an optional pass-through authentication source that accepts user identity from a client-supplied HTTP heade... | 2026-09-23 |
| CVE-2026-12974 | not reported | — | No | A Security Policy Bypass vulnerability exists in Forcepoint Security Engine (NGFW). This issue affects Forcepoint Security Engine (NGFW): f... | 2026-09-23 |
| CVE-2026-86350 | critical | 9.1 | No | Inconsistent interpretation of HTTP/2 requests ('HTTP Request/Response smuggling') vulnerability in Apache Tomcat caused by a regression in... | 2026-09-23 |
| CVE-2026-86248 | critical | 9.8 | No | CLIENT_CERT authentication does not fail as expected for some scenarios when soft fail is disabled vulnerability in Apache Tomcat. This iss... | 2026-09-23 |
| CVE-2026-96443 | medium | 6.5 | No | Insufficient validation of the JDBC driver URL in Apache Doris allows a privileged user to achieve remote code execution on the FE. | 2026-09-23 |
| CVE-2026-31377 | high | 7.5 | No | An Improper Authentication vulnerability in the Apache Doris Frontend (FE) meta service allows an unauthenticated remote attacker to access... | 2026-09-23 |
| CVE-2026-82331 | critical | 9.8 | No | Improper link resolution before file access ('link following') vulnerability in the `tar` source plugin of Apache BuildStream running on Pyt... | 2026-09-23 |
| CVE-2026-77112 | medium | 6.5 | No | Server-Side request forgery (SSRF) vulnerability in Global IT Informatics Technology Services Inc. Weoll allows Server Side Request Forgery.... | 2026-09-23 |
| CVE-2026-80444 | medium | 5.4 | No | URL redirection to untrusted site ('open redirect') vulnerability in Abis Technology Ltd. Co. AVESİS allows Input Data Manipulation. This i... | 2026-09-23 |
| CVE-2026-42801 | high | 7.4 | No | NULL pointer dereference vulnerability in ASR Crane，Falcon on Linux (as_rrc module) allows Pointer Manipulation. This vulnerability is ass... | 2026-09-23 |
| CVE-2026-92378 | not reported | — | No | A session management vulnerability exists in the Legacy UI Reduced Function Login feature of NT-ware uniFLOW Online. Under specific timing c... | 2026-09-23 |
| CVE-2026-19438 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Mint Workbench I. This issue affects Mi... | 2026-09-23 |
| CVE-2026-94574 | high | 7.8 | No | A local cross-user code execution vulnerability exists in GNU wget (Windows builds from eternallybored.org) due to a hardcoded configuration... | 2026-09-23 |
| CVE-2026-89282 | critical | 9.1 | No | The Apache Lounge Windows distribution of Apache HTTP Server build contains an insecure installation directory permissions vulnerability thr... | 2026-09-23 |
| CVE-2026-89281 | high | 8.4 | No | The Apache Lounge Windows distribution of Apache HTTP Server build contains a hardcoded configuration path vulnerability within openssl.cnf... | 2026-09-23 |