Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-49837 | medium | 5.9 | No | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Versions prior to 4.6.0 contain a BGP O... | 2026-09-16 |
| CVE-2026-29811 | high | 7.7 | No | CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normal... | 2026-09-16 |
| CVE-2026-86174 | medium | 4.3 | No | Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attacke... | 2026-09-16 |
| CVE-2026-84701 | medium | 5.4 | No | NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with... | 2026-09-16 |
| CVE-2026-83941 | high | 8.8 | No | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. | 2026-09-16 |
| CVE-2026-67633 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to deny service over a network. | 2026-09-16 |
| CVE-2026-67388 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67386 | medium | 6.5 | No | Use of uninitialized resource in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-16 |
| CVE-2026-67385 | high | 8.8 | No | Use after free in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67384 | high | 8.8 | No | Integer overflow or wraparound in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67383 | medium | 6.5 | No | Generation of error message containing sensitive information in SQL Server allows an authorized attacker to disclose information over a netw... | 2026-09-16 |
| CVE-2026-67381 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to elevate privileges over a network. | 2026-09-16 |
| CVE-2026-67380 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67379 | high | 8.5 | No | Stack-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67376 | high | 7.5 | No | Integer overflow or wraparound in SQL Server allows an unauthorized attacker to deny service over a network. | 2026-09-16 |
| CVE-2026-67373 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-16 |
| CVE-2026-67370 | high | 8.8 | No | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate... | 2026-09-16 |
| CVE-2026-67369 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-16 |
| CVE-2026-66820 | high | 8.8 | No | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate... | 2026-09-16 |
| CVE-2026-66819 | high | 8.8 | No | Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate... | 2026-09-16 |