Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80352 | critical | 9.8 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Camel K. A YAML injection vulnerability in custom resourc... | 2026-09-14 |
| CVE-2026-69379 | high | 7.0 | No | Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to elevate privileges locally. | 2026-09-14 |
| CVE-2026-80351 | critical | 9.8 | No | Improper neutralization of directives in dynamically evaluated code ('eval injection') vulnerability in Apache Camel K. An improper neutral... | 2026-09-14 |
| CVE-2026-88002 | medium | 6.5 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.1, the message-chain reconstruct... | 2026-09-14 |
| CVE-2026-69425 | medium | 4.7 | No | Improper link resolution before file access ('link following') in Windows NTFS allows an authorized attacker to perform tampering locally. | 2026-09-14 |
| CVE-2026-88001 | medium | 5.0 | No | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, server-side web fetches did n... | 2026-09-14 |
| CVE-2026-69591 | medium | 5.7 | No | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information over a network. | 2026-09-14 |
| CVE-2026-69599 | high | 7.5 | No | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | 2026-09-14 |
| CVE-2026-87926 | medium | 4.3 | No | A flaw has been found in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This issue affects some unknow... | 2026-09-14 |
| CVE-2026-85198 | medium | 6.5 | No | The MPG – Multiple Page Generator, Bulk Landing Pages & Programmatic SEO plugin for WordPress is vulnerable to generic SQL Injection via URL... | 2026-09-14 |
| CVE-2026-86793 | critical | 9.8 | No | SGLang allows unauthenticated pickle deserialization through /update_weights_from_tensor when no auth keys are configured, and the SafeUnpic... | 2026-09-14 |
| CVE-2026-81823 | medium | 5.3 | No | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resu... | 2026-09-14 |
| CVE-2026-68006 | critical | 9.1 | No | An issue in Puma v.5.0.0 and before v.8.0.3 allows an attacker to execute arbitrary code via the ext/puma_http11/http11_parser.rl file | 2026-09-14 |
| CVE-2026-38626 | critical | 9.8 | No | Garlic-Hub v1.0.1 is vulnerable to SQL Injection in src/Modules/Items/Repositories/ItemsRepository.php. | 2026-09-14 |
| CVE-2026-17585 | medium | 5.3 | No | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure... | 2026-09-14 |
| CVE-2013-1446 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. Was assigned for an old issue in the brltty daem... | 2026-09-14 |
| CVE-2026-68884 | high | 7.0 | No | Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. | 2026-09-14 |
| CVE-2026-69501 | high | 7.0 | No | Untrusted pointer dereference in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally. | 2026-09-14 |
| CVE-2026-69536 | high | 7.1 | No | Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network. | 2026-09-14 |
| CVE-2026-87921 | high | 7.3 | No | A vulnerability was identified in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is the funct... | 2026-09-14 |