Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91981 | medium | 4.3 | No | Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only sh... | 2026-09-21 |
| CVE-2026-91971 | medium | 6.5 | No | Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to u... | 2026-09-21 |
| CVE-2026-88259 | high | 7.5 | No | CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with... | 2026-09-21 |
| CVE-2026-85497 | critical | 9.8 | No | CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance... | 2026-09-21 |
| CVE-2026-85478 | low | 3.5 | No | A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface wit... | 2026-09-21 |
| CVE-2026-77972 | not reported | — | No | Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach intern... | 2026-09-21 |
| CVE-2026-75894 | high | 7.5 | No | In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU th... | 2026-09-21 |
| CVE-2026-76861 | high | 8.8 | No | Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call... | 2026-09-21 |
| CVE-2026-76856 | high | 8.1 | No | Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_se... | 2026-09-21 |
| CVE-2026-77866 | not reported | — | No | Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network d... | 2026-09-21 |
| CVE-2026-75893 | high | 7.5 | No | In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame l... | 2026-09-21 |
| CVE-2026-75892 | medium | 6.5 | No | In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-fiel... | 2026-09-21 |
| CVE-2026-47321 | high | 7.5 | No | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not cont... | 2026-09-21 |
| CVE-2026-19407 | not reported | — | No | Bucket Squatting in Google Cloud Gemini Enterprise Agent Platform SDK for Python versions prior to 1.166.1 allows an attacker to achieve Rem... | 2026-09-21 |
| CVE-2026-69586 | critical | 9.8 | No | Integer overflow or wraparound in Microsoft Windows PDF allows an unauthorized attacker to execute code over a network. | 2026-09-21 |
| CVE-2026-69597 | high | 7.5 | No | Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. | 2026-09-21 |
| CVE-2026-92954 | high | 8.6 | No | vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host r... | 2026-09-21 |
| CVE-2026-92949 | medium | 4.0 | No | vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts... | 2026-09-21 |
| CVE-2026-92467 | high | 8.3 | No | zlt2000 microservices-platform through 6.0.0 contains an unverified password change vulnerability in the PUT /users/password endpoint that a... | 2026-09-21 |
| CVE-2026-83265 | high | 8.2 | No | Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Agent). Supported versions tha... | 2026-09-21 |