Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-12611 | not reported | — | No | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads... | 2026-09-09 |
| CVE-2026-77847 | medium | 6.5 | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow a... | 2026-09-09 |
| CVE-2026-7861 | critical | 9.8 | No | Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Inje... | 2026-09-09 |
| CVE-2026-86504 | high | 7.8 | No | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execut... | 2026-09-09 |
| CVE-2026-86502 | high | 8.4 | No | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote De... | 2026-09-09 |
| CVE-2026-86480 | critical | 9.8 | No | In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges | 2026-09-09 |
| CVE-2026-86479 | high | 8.1 | No | In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resourc... | 2026-09-09 |
| CVE-2026-86478 | critical | 9.8 | No | In JetBrains YouTrack before 2025.3.161254, 2026.1.14042 improper authentication in YouTrack Helpdesk allowed unauthenticated account takeo... | 2026-09-09 |
| CVE-2026-83534 | medium | 6.4 | No | PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run ar... | 2026-09-09 |
| CVE-2026-86218 | critical | 9.8 | Listed | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. | 2026-09-09 |
| CVE-2026-83527 | high | 8.1 | No | An Authentication Bypass vulnerability in Sentry before R10.8.2, R10.7.3 and R10.6.4 allows a remote unauthenticated attacker to gain admini... | 2026-09-09 |
| CVE-2026-81963 | high | 7.8 | Listed | Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges l... | 2026-09-09 |
| CVE-2026-76967 | high | 7.8 | No | SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup.... | 2026-09-09 |
| CVE-2026-75650 | critical | 10.0 | Listed | Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in ar... | 2026-09-09 |
| CVE-2026-66768 | critical | 9.0 | No | SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-priv... | 2026-09-09 |
| CVE-2026-66767 | high | 7.7 | No | SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers... | 2026-09-09 |
| CVE-2026-58240 | critical | 9.8 | No | SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration.... | 2026-09-09 |
| CVE-2026-45200 | high | 7.8 | No | Software installed and run as a non-privileged user may conduct improper GPU driver IOCTL calls to create an allocation scenario that when f... | 2026-09-09 |
| CVE-2026-19634 | medium | 6.4 | No | PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing... | 2026-09-09 |
| CVE-2026-19633 | high | 8.8 | No | PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain... | 2026-09-09 |