Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86488 | medium | 6.5 | No | In JetBrains YouTrack before 2026.2.18634 iDOR via the watchRules and issueListConfig endpoints exposed private saved searches | 2026-09-08 |
| CVE-2026-86487 | low | 3.1 | No | In JetBrains YouTrack before 2026.2.18634 a crafted WebSocket message allowed read-only whiteboard users to modify canvas content | 2026-09-08 |
| CVE-2026-86486 | low | 3.7 | No | In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank | 2026-09-08 |
| CVE-2026-86485 | low | 3.3 | No | In JetBrains YouTrack before 2026.2.18634 iP spoofing via HTTP headers allowed forged Bitbucket webhooks | 2026-09-08 |
| CVE-2026-86484 | medium | 4.6 | No | In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS | 2026-09-08 |
| CVE-2026-86483 | medium | 5.4 | No | In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible | 2026-09-08 |
| CVE-2026-86481 | medium | 4.3 | No | In JetBrains YouTrack before 2026.2.18634 signed URL reuse allowed disclosure of restricted project icons | 2026-09-08 |
| CVE-2026-86505 | low | 3.3 | No | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust check leaked project metadata to JetBrains Marketplace | 2026-09-08 |
| CVE-2026-86503 | low | 3.3 | No | In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching | 2026-09-08 |
| CVE-2026-86501 | low | 2.8 | No | In JetBrains IntelliJ IDEA before 2026.2.2 terminal command input could be written to idea.log | 2026-09-08 |
| CVE-2026-77393 | high | 8.8 | No | In Ignition 8.1.53 and earlier, the Gateway "Create Project Role(s)" setting shipped blank, which permitted any authenticated user to create... | 2026-09-08 |
| CVE-2026-75925 | critical | 9.6 | No | Improper neutralization of CRLF sequences in IXON VPN Client before version 1.4.7 allows an attacker to execute commands as root or SYSTEM.... | 2026-09-08 |
| CVE-2026-82712 | high | 8.8 | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a cross-site request forgery vulnerability. This could allow an... | 2026-09-08 |
| CVE-2026-45197 | low | 2.5 | No | Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a read and/or write data o... | 2026-09-08 |
| CVE-2026-78012 | critical | 9.8 | No | An issue in the NetStaX EtherNet/IP Stack prior to v5.6.1 could allow a large Class 3 explicit-message request to exceed the application-sid... | 2026-09-08 |
| CVE-2026-15431 | not reported | — | No | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.53.2.0. The vulnerability could... | 2026-09-08 |
| CVE-2026-0001 | medium | 4.4 | No | Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm Ltd Arm 5th Gen GPU Architecture K... | 2026-09-08 |
| CVE-2026-8279 | medium | 5.3 | No | The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_per... | 2026-09-08 |
| CVE-2026-86317 | medium | 5.3 | No | A vulnerability was detected in ggml-org llama.cpp up to 0.4.0. This impacts the function rpc_server::deserialize_tensor of the file ggml/sr... | 2026-09-08 |
| CVE-2026-86301 | low | 3.5 | No | A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patien... | 2026-09-08 |