Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83283 | critical | 9.8 | No | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security). The support... | 2026-09-22 |
| CVE-2026-83269 | critical | 9.8 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-22 |
| CVE-2026-93314 | medium | 6.3 | No | A vulnerability was determined in Freedesktop Poppler 26.07.0. This affects the function FoFiTrueType::mapCodeToGID of the file fofi/FoFiTru... | 2026-09-22 |
| CVE-2026-93309 | medium | 4.3 | No | A vulnerability was determined in O-RAN-SC SMO OAM 2025-06-10. Affected by this issue is some unknown functionality of the component VES Col... | 2026-09-22 |
| CVE-2026-20516 | medium | 5.5 | No | In MiracastService, there is a possible escalation of privilege due to a confused deputy. This could lead to local denial of service with Us... | 2026-09-22 |
| CVE-2026-54613 | medium | 5.4 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, getThemeFolder() i... | 2026-09-22 |
| CVE-2026-94143 | high | 7.3 | No | A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library M... | 2026-09-21 |
| CVE-2026-94033 | low | 3.5 | No | A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_r... | 2026-09-21 |
| CVE-2026-93980 | high | 7.3 | No | A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin... | 2026-09-21 |
| CVE-2026-93975 | low | 2.4 | No | A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php... | 2026-09-21 |
| CVE-2026-93965 | medium | 6.6 | No | A flaw has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected is the function subprocess.Popen of the file backend/aiops/services.py of the... | 2026-09-21 |
| CVE-2026-93955 | medium | 4.3 | No | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToRespon... | 2026-09-21 |
| CVE-2026-93981 | medium | 4.7 | No | hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBou... | 2026-09-21 |
| CVE-2026-93685 | medium | 5.4 | No | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a mis... | 2026-09-21 |
| CVE-2026-93605 | critical | 10.0 | No | vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite b... | 2026-09-21 |
| CVE-2026-93595 | medium | 6.5 | No | ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The... | 2026-09-21 |
| CVE-2026-93013 | medium | 4.3 | No | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoint... | 2026-09-21 |
| CVE-2026-92961 | high | 7.5 | No | vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to al... | 2026-09-21 |
| CVE-2026-92927 | medium | 5.3 | No | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_... | 2026-09-21 |
| CVE-2026-92959 | high | 7.1 | No | vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a... | 2026-09-21 |