Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84698 | medium | 6.5 | No | PX4 Autopilot contains a heap buffer overflow vulnerability in the sd_bench command that writes a four-byte block number into a user-supplie... | 2026-09-10 |
| CVE-2026-84200 | critical | 9.0 | No | Kyverno versions v1.9.0 through v1.12.7 contain a policy exception handling flaw. When a policy in enforce mode is combined with two PolicyE... | 2026-09-10 |
| CVE-2026-84196 | high | 7.7 | No | Kyverno before 1.18.0 contains a server-side request forgery vulnerability in apiCall.service.url that allows authenticated users to send ar... | 2026-09-10 |
| CVE-2026-84195 | high | 7.7 | No | Kyverno before 1.16.4 automatically attaches the admission controller's ServiceAccount token to outbound HTTP requests in apiCall service mo... | 2026-09-10 |
| CVE-2026-79909 | high | 7.8 | No | Acrobat Reader is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current use... | 2026-09-10 |
| CVE-2026-80160 | medium | 5.5 | No | Acrobat Reader is affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could lever... | 2026-09-10 |
| CVE-2026-78464 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally... | 2026-09-10 |
| CVE-2026-88873 | high | 7.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in view/logArchive.j... | 2026-09-10 |
| CVE-2026-88872 | high | 7.1 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in the setPassword.json.p... | 2026-09-10 |
| CVE-2026-88868 | high | 8.7 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LiveLinks plugin... | 2026-09-10 |
| CVE-2026-88867 | high | 8.7 | No | WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnera... | 2026-09-10 |
| CVE-2026-88863 | high | 8.1 | No | capgo.app (npm package `capgo`) through version 12.207.1 does not compare the caller's role rank against the requested role in the validateI... | 2026-09-10 |
| CVE-2026-87922 | high | 7.3 | No | A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected by this... | 2026-09-10 |
| CVE-2026-87822 | high | 7.5 | No | t-digest versions 3.1 through 3.3 fail to validate centroid means during deserialization in MergingDigest.fromBytes, allowing attackers to i... | 2026-09-10 |
| CVE-2026-87812 | medium | 6.8 | No | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in Bazaar package cards where the iconURL metadata is inserted dir... | 2026-09-10 |
| CVE-2026-87641 | medium | 4.2 | No | Race condition in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a craft... | 2026-09-10 |
| CVE-2026-80162 | medium | 5.5 | No | Acrobat Reader is affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage t... | 2026-09-10 |
| CVE-2026-86198 | medium | 4.2 | No | PocketMine-MP versions before 5.44.2 fail to properly validate multiple ResourcePackClientResponsePacket packets with STATUS_COMPLETED statu... | 2026-09-10 |
| CVE-2026-85983 | high | 7.8 | No | The Auth0 AD/LDAP Connector improperly processes a configuration value during service startup. This allows a low-privileged user on the host... | 2026-09-10 |
| CVE-2026-85545 | high | 7.1 | No | There is an Vulnerability in some HikCentral Access Control versions. Authenticated low-privilege users can invoke API interfaces that their... | 2026-09-10 |