Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75687 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-10 |
| CVE-2026-75679 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-10 |
| CVE-2026-75672 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-10 |
| CVE-2026-74237 | medium | 6.5 | No | GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools... | 2026-09-10 |
| CVE-2026-71805 | critical | 9.8 | No | An arbitrary file upload and path traversal vulnerability exists in LZ-litchi 1.0.0. Unauthenticated remote attackers can upload arbitrary f... | 2026-09-10 |
| CVE-2026-71808 | high | 8.8 | No | A SQL Injection vulnerability in Siam Ordering (siam-server) 1.0.0 allows remote authenticated attackers to execute arbitrary SQL commands v... | 2026-09-10 |
| CVE-2026-71613 | high | 7.8 | No | Buffer Overflow vulnerability in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to execute arbitrary code via the j2kdec_p... | 2026-09-10 |
| CVE-2026-56101 | medium | 5.3 | No | OpenBSD before commit 1ee99df contains an inverted comparison vulnerability in the ieee80211_michael_mic_failure() function within sys/net80... | 2026-09-10 |
| CVE-2026-54694 | critical | 9.6 | No | SkillTree is a micro-learning gamification platform. Prior to version 4.4.2, two independent code flaws combine into a single exploitable at... | 2026-09-10 |
| CVE-2026-42807 | high | 8.0 | No | A heap-based buffer overflow vulnerability in the PC bridge protocol decoder of BoschSensortec COINES_SDK (versions 2.10 through 2.12.2) all... | 2026-09-10 |
| CVE-2026-42806 | medium | 4.3 | No | An out-of-bounds read vulnerability was discovered in the Bosch BME690 SensorAPI (C-driver) in version v1.0.3 and prior, specifically within... | 2026-09-10 |
| CVE-2026-42805 | high | 8.4 | No | A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI385 SensorAPI (C library) within the debug message parser funct... | 2026-09-10 |
| CVE-2026-42804 | high | 7.6 | No | A stack-based buffer overflow vulnerability exists in the Bosch Sensortec BHI360 SensorAPI(C-Library) in versions up to and including commit... | 2026-09-10 |
| CVE-2026-36433 | critical | 9.8 | No | An issue in Actions Semiconductor Co. Ltd Tool- Media Player Utilities v.4.46 allows a physically proximate attacker execute arbitrary code... | 2026-09-10 |
| CVE-2026-19625 | medium | 5.3 | No | When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by... | 2026-09-10 |
| CVE-2026-19298 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote authenticated attacker to execute arbitrary code due to an authorization bypass i... | 2026-09-10 |
| CVE-2026-18076 | medium | 6.5 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a memory leak. | 2026-09-10 |
| CVE-2026-17483 | low | 3.3 | No | IBM Db2 Mirror for i 7.4, 7.5, and 7.6 IBM i could allow a local attacker to delete historical flight-recorder archives due to improper acce... | 2026-09-10 |
| CVE-2026-17442 | medium | 5.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-10 |
| CVE-2026-17255 | high | 7.5 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to cause a denial of service due to improper validation of the prefix length in I... | 2026-09-10 |