Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87187 | high | 8.8 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87188 | critical | 9.8 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-87189 | critical | 9.1 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-22 |
| CVE-2026-69720 | high | 7.8 | No | Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-72926 | high | 7.0 | No | Use after free in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate privileges locally. | 2026-09-22 |
| CVE-2026-84963 | medium | 5.3 | No | An incorrect numeric conversion in the JSON parsing component of the MongoDB C Driver's BSON library may cause an unusually large text value... | 2026-09-22 |
| CVE-2026-84964 | high | 7.5 | No | A double free in the OpenSSL-based TLS certificate revocation checking path of the MongoDB C Driver can be reached by a TLS endpoint that th... | 2026-09-22 |
| CVE-2026-95806 | not reported | — | No | MISP ships with PHP's phar stream wrapper registered in both its web entry point and its console entry point. The phar stream wrapper caus... | 2026-09-22 |
| CVE-2026-95805 | not reported | — | No | A typo in the MISP ACLComponent access control configuration caused the ACL rule for the previewEventAttributes action to reference the perm... | 2026-09-22 |
| CVE-2026-95754 | not reported | — | No | In MISP's UsersController login() method, the pre-authentication database query used for the TOTP (two-factor authentication) verification b... | 2026-09-22 |
| CVE-2026-95703 | not reported | — | No | In MISP, the OrganisationsController::__uploadLogo method processed a caller-supplied tmp_name value with filesystem probes (file_exists, MI... | 2026-09-22 |
| CVE-2026-95701 | not reported | — | No | In MISP, the __statisticsOrgs method in UsersController.php used the organization name directly as a file-system path component when checkin... | 2026-09-22 |
| CVE-2026-95698 | not reported | — | No | The findOrgImage method in MISP's OrgImgHelper constructs a filesystem path by concatenating a user-supplied organization identifier with a... | 2026-09-22 |
| CVE-2026-95697 | not reported | — | No | MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unco... | 2026-09-22 |
| CVE-2026-95693 | not reported | — | No | In MISP, the EventReport::uploadPicture method in processed a caller-supplied tmp_name field by invoking file_exists(), mime_content_type(),... | 2026-09-22 |
| CVE-2026-95685 | not reported | — | No | MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of s... | 2026-09-22 |
| CVE-2026-95683 | not reported | — | No | In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched t... | 2026-09-22 |
| CVE-2026-95682 | not reported | — | No | MISP contains a stored cross-site scripting (XSS) vulnerability in the admin email composition screen. The MISP.org organization name settin... | 2026-09-22 |
| CVE-2026-95679 | not reported | — | No | MISP's RequestHandlerComponent automatically decodes XML request bodies on all write requests. The underlying Xml::build() library contains... | 2026-09-22 |
| CVE-2026-95674 | not reported | — | No | In MISP, the queryEnrichment method in EventsController.php accepted a module name parameter and iterated over the list of enabled modules t... | 2026-09-22 |