Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84332 | medium | 6.5 | No | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictio... | 2026-09-03 |
| CVE-2026-84334 | high | 8.1 | No | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary co... | 2026-09-03 |
| CVE-2026-84335 | high | 8.3 | No | Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-67394 | not reported | — | No | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions... | 2026-09-03 |
| CVE-2026-48932 | low | 3.7 | No | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from... | 2026-09-03 |
| CVE-2026-78319 | not reported | — | No | A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote... | 2026-09-03 |
| CVE-2026-84851 | high | 7.5 | No | An uncontrolled recursion issue exists in Amazon Ion-C versions before 1.1.6 that might allow a remote unauthenticated actor to craft Ion da... | 2026-09-03 |
| CVE-2026-83551 | high | 7.2 | No | Cleartext storage of sensitive information in the @step and @remote decorator pipeline component in Amazon SageMaker Python SDK before v3.11... | 2026-09-03 |
| CVE-2026-17539 | medium | 5.9 | No | RTU500 has a vulnerability, where high-load scenarios, such as sending GI requests at short intervals, may cause a NULL pointer dereference... | 2026-09-03 |
| CVE-2026-85199 | not reported | — | No | Eclipse aeriOS Self-orchestrator versions prior to 1.2.1 contain a path traversal vulnerability in the REST API. User-controlled identifiers... | 2026-09-03 |
| CVE-2026-82180 | not reported | — | No | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 when the MQTT API is enabled with the certificate authentication policy, CertificateMqttFi... | 2026-09-03 |
| CVE-2026-80515 | not reported | — | No | In Eclipse Arrowhead versions from 5.0.0 to 5.2.1 the management-authorization gate that protects every /…/mgmt/… REST endpoint decides whet... | 2026-09-03 |
| CVE-2026-79679 | high | 8.7 | No | Use of Weak Credentials vulnerability in B&R Industrial Automation GmbH mapp Audit used in mapp Services. This issue affects mapp Audit use... | 2026-09-03 |
| CVE-2026-19117 | critical | 9.8 | No | Under specific conditions, an attacker can register an attacker-controlled FIDO2 credential against a target account and then authenticate a... | 2026-09-03 |
| CVE-2026-82955 | not reported | — | No | In the current development version of Eclipse aeriOS, which has not yet had an official release, the KrakenD instance included in the API Ga... | 2026-09-03 |
| CVE-2026-82958 | not reported | — | No | In Eclipse Ditto versions [1.3.0, 3.9.6], the ImplicitThingCreationMessageMapper of the connectivity service builds a CreateThing command by... | 2026-09-03 |
| CVE-2026-84175 | not reported | — | No | In Eclipse Ditto versions 3.0.0 to 3.9.6, the Things service fetches WoT (Web of Things) ThingModels over HTTP from URLs supplied by API use... | 2026-09-03 |
| CVE-2026-81928 | high | 7.5 | No | Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplac... | 2026-09-03 |
| CVE-2026-19475 | medium | 6.5 | No | An authenticated user with permission to query a SQL data source can bypass the fix for CVE-2026-33375 by injecting the timeGroup macro thro... | 2026-09-03 |
| CVE-2026-18329 | high | 8.2 | No | Description NGINX JavaScript (njs) and QuickJS (qjs) engines have a vulnerability when a js_access handler performs asynchronous request bo... | 2026-09-03 |