Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75160 | critical | 9.1 | No | An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi... | 2026-09-08 |
| CVE-2026-85509 | critical | 9.8 | No | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than... | 2026-09-08 |
| CVE-2026-85508 | critical | 9.8 | No | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (... | 2026-09-08 |
| CVE-2026-85504 | critical | 9.8 | No | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string... | 2026-09-08 |
| CVE-2026-52111 | critical | 9.8 | No | An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes aut... | 2026-09-08 |
| CVE-2026-51974 | high | 8.8 | No | An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remo... | 2026-09-08 |
| CVE-2026-18221 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authent... | 2026-09-08 |
| CVE-2026-18341 | high | 8.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to corrupt memory due to an integer underflow. | 2026-09-08 |
| CVE-2026-83557 | medium | 5.6 | No | DefaultBaseTypeLimitingValidator is the PolymorphicTypeValidator applied automatically whenever @JsonTypeInfo is used without an explicitly... | 2026-09-08 |
| CVE-2026-19032 | medium | 5.3 | No | jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStrin... | 2026-09-08 |
| CVE-2026-78230 | not reported | — | No | AshAi exposes Ash read actions to language-model tool calls. The read tool accepts an aggregate result type (min, max, sum, avg) that builds... | 2026-09-08 |
| CVE-2026-78216 | not reported | — | No | AshLua exposes Ash read actions to Lua scripts run through an eval action. A read call accepts an operation (list, min, max, first, sum, avg... | 2026-09-08 |
| CVE-2026-85458 | not reported | — | No | Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height. | 2026-09-08 |
| CVE-2026-79603 | medium | 4.3 | No | x86 PV guests can free memory pages while still keeping a stale TLB entry pointing to them. A TLB flush is only issued by Xen (if needed) wh... | 2026-09-08 |
| CVE-2026-6244 | medium | 5.5 | No | libpcap BPF interpreter for the 'div #k' and 'mod #k' ALU instructions does not check whether the immediate value is zero. In particular unc... | 2026-09-08 |
| CVE-2026-31912 | medium | 5.5 | No | libpcap BPF interpreter detects neither reaching the end of the filter program buffer due to lack of a return instruction nor executing a ju... | 2026-09-08 |
| CVE-2026-31911 | medium | 5.5 | No | libpcap BPF interpreter calls abort() if it encounters a BPF instruction that has an invalid opcode. In particular uncommon use cases a craf... | 2026-09-08 |
| CVE-2026-18313 | medium | 4.3 | No | rpcapd can allocate up to 65536 bytes per each RPCAP_MSG_UPDATEFILTER_REQ or RPCAP_MSG_STARTCAP_REQ message received from the client, but it... | 2026-09-08 |
| CVE-2026-18238 | medium | 5.0 | No | The rpcap client code that processes a RPCAP_MSG_PACKET message received from the server incorrectly validates its headers. A malicious serv... | 2026-09-08 |
| CVE-2026-0799 | high | 8.7 | No | In BPF instructions that load/store a value from/to a scratch memory register the register index is an unsigned 32-bit integer and must not... | 2026-09-08 |