Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87280 | medium | 4.2 | No | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.... | 2026-09-23 |
| CVE-2026-87281 | low | 3.2 | No | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.... | 2026-09-23 |
| CVE-2026-87282 | medium | 6.0 | No | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.... | 2026-09-23 |
| CVE-2026-87283 | medium | 6.0 | No | Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.2.... | 2026-09-23 |
| CVE-2026-82000 | critical | 9.6 | No | Adobe Experience Manager Forms JEE is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in privilege escalati... | 2026-09-23 |
| CVE-2026-81995 | critical | 9.1 | No | Adobe Experience Manager Forms JEE is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution i... | 2026-09-23 |
| CVE-2026-77006 | critical | 9.6 | No | The WebTotem Backups WordPress plugin before 1.1.0 does not validate a user-supplied file path, does not check the capability of the user ma... | 2026-09-23 |
| CVE-2026-73014 | high | 7.8 | No | Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. | 2026-09-23 |
| CVE-2026-92360 | medium | 6.3 | No | A weakness has been identified in ag-ui-protocol ag-ui 1.0. The impacted element is the function prepareRunAgentInput of the file agent/agen... | 2026-09-23 |
| CVE-2026-92359 | low | 3.1 | No | A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integ... | 2026-09-23 |
| CVE-2026-88817 | not reported | — | No | An authenticated, non-guest user of Curiosity Workspace could enroll themselves as an administrator and member of an existing access group w... | 2026-09-23 |
| CVE-2026-73175 | not reported | — | No | Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-... | 2026-09-23 |
| CVE-2026-73174 | not reported | — | No | Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protoco... | 2026-09-23 |
| CVE-2026-73173 | not reported | — | No | Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol o... | 2026-09-23 |
| CVE-2026-73172 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73171 | not reported | — | No | Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EK... | 2026-09-23 |
| CVE-2026-73170 | not reported | — | No | Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import w... | 2026-09-23 |
| CVE-2026-73169 | not reported | — | No | Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability... | 2026-09-23 |
| CVE-2026-73167 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73166 | not reported | — | No | Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inte... | 2026-09-23 |