Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86170 | medium | 6.3 | No | A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php... | 2026-09-09 |
| CVE-2026-76961 | low | 3.5 | No | SAP S/4HANA Finance (Advanced Payment Management) does not perform sufficient Cross-Site Request Forgery protection on certain requests, due... | 2026-09-09 |
| CVE-2026-17440 | medium | 5.5 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1... | 2026-09-09 |
| CVE-2026-18851 | high | 8.8 | No | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attac... | 2026-09-09 |
| CVE-2026-86733 | high | 7.2 | No | Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client (`mysql`) wi... | 2026-09-09 |
| CVE-2026-76196 | high | 7.4 | No | Photoshop Mobile is affected by a Session Fixation vulnerability that could result in privilege escalation. An attacker could leverage this... | 2026-09-09 |
| CVE-2026-79904 | medium | 5.0 | No | Photoshop Mobile is affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could r... | 2026-09-09 |
| CVE-2026-77109 | high | 8.6 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage... | 2026-09-09 |
| CVE-2026-76201 | critical | 9.3 | No | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri... | 2026-09-09 |
| CVE-2026-76200 | critical | 9.3 | No | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri... | 2026-09-09 |
| CVE-2026-77774 | high | 8.6 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker could lev... | 2026-09-09 |
| CVE-2026-86735 | medium | 5.0 | No | snipe-it versions before 8.7.0 contain a server-side request forgery vulnerability in the ExternalUrl validation rule that fails to detect I... | 2026-09-09 |
| CVE-2026-83961 | high | 7.1 | No | ColdFusion is affected by an Improper Authentication vulnerability that could result in privilege escalation. An attacker could leverage thi... | 2026-09-09 |
| CVE-2026-78254 | high | 7.4 | No | The ftp and scp tasks of Apache Ant can download files from a remote server. A malicious server can provide relative paths that allow it to... | 2026-09-09 |
| CVE-2026-86738 | high | 8.7 | No | Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HT... | 2026-09-09 |
| CVE-2026-12611 | not reported | — | No | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads... | 2026-09-09 |
| CVE-2026-77847 | medium | 6.5 | No | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a use of hard-coded credential vulnerability. This could allow a... | 2026-09-09 |
| CVE-2026-7861 | critical | 9.8 | No | Deserialization of untrusted data vulnerability in Next4Biz Information Technologies Inc. CSM (Customer Service Management) allows Code Inje... | 2026-09-09 |
| CVE-2026-86504 | high | 7.8 | No | In JetBrains IntelliJ IDEA before 2026.2.2 missing project-trust confirmation before building a Dev Container allowed host-level code execut... | 2026-09-09 |
| CVE-2026-86502 | high | 8.4 | No | In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote De... | 2026-09-09 |