Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16826 | high | 7.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local attacker to execute arbitrary commands due to improper neutralization of special elements u... | 2026-09-10 |
| CVE-2026-14470 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.10.2 could allow an authenticated attacker to traverse directories on the system. An attacker could send a... | 2026-09-10 |
| CVE-2026-79910 | medium | 5.5 | No | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lever... | 2026-09-10 |
| CVE-2026-81992 | high | 7.8 | No | Acrobat Reader is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the... | 2026-09-10 |
| CVE-2026-81987 | high | 7.8 | No | Acrobat Reader is affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context o... | 2026-09-10 |
| CVE-2026-80161 | high | 7.8 | No | Acrobat Reader is affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary... | 2026-09-10 |
| CVE-2026-79907 | high | 7.8 | No | Acrobat Reader is affected by a Double Free vulnerability that could result in arbitrary code execution in the context of the current user.... | 2026-09-10 |
| CVE-2026-87962 | high | 7.5 | No | t-digest versions 3.1 through 3.3 contain a denial of service vulnerability in MergingDigest.fromBytes that fails to validate length and cap... | 2026-09-10 |
| CVE-2026-87961 | high | 7.1 | No | ESP32-audioI2S versions 3.4.4 through 4.0.0 contain a heap-based out-of-bounds read vulnerability in the read_ID3_Header function due to a s... | 2026-09-10 |
| CVE-2026-87803 | high | 7.1 | No | An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sa... | 2026-09-10 |
| CVE-2026-15913 | high | 7.7 | No | In versions prior to 7.10.2 a path traversal vulnerability in the /attachRemoteFiles endpoint of Fortra's GoAnywhere MFT allows Web Users wi... | 2026-09-10 |
| CVE-2026-53956 | medium | 5.4 | No | Rattler is a library that provides common functionality used within the conda ecosystem. `rattler_cache` prior to version 0.9.0 and `py-ratt... | 2026-09-10 |
| CVE-2026-87911 | critical | 9.6 | No | An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1... | 2026-09-10 |
| CVE-2026-47156 | not reported | — | No | MantisBT is an open source bug tracker. Versions 2.28.3 and earlier contain a critical authentication bypass in the SOAP API's mci_check_log... | 2026-09-10 |
| CVE-2026-82563 | high | 7.6 | No | An attacker could impersonate the camera and place themselves in a man-in-the-middle or device-emulation position. This permits manipulation... | 2026-09-10 |
| CVE-2026-81640 | high | 8.8 | No | An attacker could derive the camera's Wi-Fi password and connect to its wireless network. This weakens or eliminates the security value of t... | 2026-09-10 |
| CVE-2026-81330 | medium | 6.5 | No | The C6 ear camera transmits live video to the EarVision Android application over unencrypted UDP streams. The application manifest permits c... | 2026-09-10 |
| CVE-2026-77974 | high | 8.0 | No | After spoofing the device and obtaining one user confirmation, an attacker may be able to cause the application to transmit firmware through... | 2026-09-10 |
| CVE-2026-87816 | high | 7.5 | No | PasswordPusher before 2.11.1 contains a time-of-check-to-time-of-use race condition in view limit enforcement that allows unauthenticated at... | 2026-09-10 |
| CVE-2026-86777 | medium | 5.3 | No | AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated att... | 2026-09-10 |