Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-52098 | critical | 9.8 | No | An issue in Flowise 3.1.2 allows a remote attacker to execute arbitrary code via the /api/v1/prediction/ endpoint | 2026-09-15 |
| CVE-2026-90534 | medium | 6.5 | No | Flowise is a low-code platform for building LLM applications. In versions up to and including 3.1.3, the POST /api/v1/node-load-method/:name... | 2026-09-15 |
| CVE-2026-90535 | high | 7.5 | No | Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that a... | 2026-09-15 |
| CVE-2026-67638 | high | 8.8 | No | Heap-based buffer overflow in SQL Server allows an authorized attacker to execute code over a network. | 2026-09-15 |
| CVE-2026-67393 | medium | 6.5 | No | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-67368 | high | 8.8 | No | Improper link resolution before file access ('link following') in SQL Server allows an authorized attacker to elevate privileges over a netw... | 2026-09-15 |
| CVE-2026-67390 | medium | 6.5 | No | Buffer over-read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-67389 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-09-15 |
| CVE-2026-90533 | medium | 6.5 | No | Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organizati... | 2026-09-15 |
| CVE-2026-14199 | high | 8.1 | No | Only self-managed Grafana instances with Auth Proxy authentication and identity caching enabled (sync_ttl greater than zero) are affected. T... | 2026-09-15 |
| CVE-2026-91089 | medium | 6.3 | No | A vulnerability was found in GPAC up to f1219cde. Impacted is the function gf_node_get_name_and_id of the file scenegraph/base_scenegraph.c.... | 2026-09-15 |
| CVE-2026-90880 | high | 7.4 | No | A security flaw has been discovered in D-Link DSL-3782 2016-07-28. This issue affects the function system of the file /cgi-bin/New_GUI/Set/D... | 2026-09-15 |
| CVE-2026-90858 | high | 7.3 | No | A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected by this vulne... | 2026-09-15 |
| CVE-2026-90714 | medium | 6.3 | No | A weakness has been identified in marcobambini Gravity up to 0.9.7. The impacted element is an unknown function of the file src/utils/gravit... | 2026-09-15 |
| CVE-2026-90703 | critical | 9.1 | No | A vulnerability has been found in D-Link DWR-M921 1.1.52. The affected element is the function system of the file /boafrm/formDiskCreateShar... | 2026-09-15 |
| CVE-2026-90683 | low | 3.3 | No | A vulnerability was detected in GPAC up to f1219cde. Affected is the function gf_node_unregister of the file scenegraph/base_scenegraph.c of... | 2026-09-15 |
| CVE-2026-90622 | low | 3.3 | No | A security flaw has been discovered in GNU libredwg 0.13.4. This impacts the function DWG_TABLE of the file src/dwg.spec of the component La... | 2026-09-15 |
| CVE-2026-90617 | high | 7.3 | No | A vulnerability was detected in GH05TCREW PentestAgent up to cf882dabea3ed91cef016cdd115e5426315665a2. This vulnerability affects the functi... | 2026-09-15 |
| CVE-2026-90596 | medium | 6.5 | No | A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file... | 2026-09-15 |
| CVE-2026-90583 | medium | 4.3 | No | A security flaw has been discovered in kagisearch smallweb up to 0ecb9c48edbf98dc7e934b54fbac43869e64b4cf. The affected element is the funct... | 2026-09-15 |