Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87252 | medium | 6.8 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected... | 2026-09-23 |
| CVE-2026-87253 | medium | 6.1 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Web Client). The supported version that is affected is 9.3.... | 2026-09-23 |
| CVE-2026-87254 | high | 7.5 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that i... | 2026-09-23 |
| CVE-2026-87256 | high | 7.7 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server). The supported version that is affected... | 2026-09-23 |
| CVE-2026-87257 | high | 7.7 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: SDK). The supported version that is affected is 9.3.6. Easi... | 2026-09-23 |
| CVE-2026-87258 | high | 7.6 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that i... | 2026-09-23 |
| CVE-2026-78552 | medium | 4.9 | No | The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is inter... | 2026-09-23 |
| CVE-2026-59830 | medium | 5.4 | No | Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names... | 2026-09-23 |
| CVE-2026-83621 | high | 8.1 | No | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scrip... | 2026-09-23 |
| CVE-2026-94382 | medium | 4.2 | No | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that... | 2026-09-23 |
| CVE-2026-96560 | critical | 9.8 | No | LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, whic... | 2026-09-23 |
| CVE-2026-82412 | high | 8.8 | No | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/... | 2026-09-23 |
| CVE-2026-93750 | medium | 5.9 | No | http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate... | 2026-09-23 |
| CVE-2026-62282 | medium | 6.5 | No | OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not s... | 2026-09-23 |
| CVE-2026-53557 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a craft... | 2026-09-23 |
| CVE-2026-53556 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData... | 2026-09-23 |
| CVE-2026-53555 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an... | 2026-09-23 |
| CVE-2026-53554 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel e... | 2026-09-23 |
| CVE-2026-50022 | medium | 5.8 | No | Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwar... | 2026-09-23 |
| CVE-2026-92783 | high | 8.1 | No | Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete... | 2026-09-23 |