Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-68645 | high | 8.8 | Listed | A Local File Inclusion (LFI) vulnerability exists in the Webmail Classic UI of Zimbra Collaboration (ZCS) 10.0 and 10.1 because of improper... | 2026-11-04 |
| CVE-2026-83128 | high | 7.5 | No | Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are a... | 2026-11-04 |
| CVE-2026-83424 | high | 7.5 | No | Vulnerability in the Oracle JDeveloper product of Oracle Fusion Middleware (component: Oracle JDeveloper). Supported versions that are affec... | 2026-11-04 |
| CVE-2026-91552 | high | 7.5 | No | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are af... | 2026-11-04 |
| CVE-2026-91542 | high | 7.5 | No | Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites). Supported versions that are af... | 2026-11-04 |
| CVE-2026-97373 | medium | 5.8 | No | draw.io is a configurable diagramming and whiteboarding application. Prior to 30.3.8, the optional /proxy endpoint contains an incomplete se... | 2026-11-04 |
| CVE-2026-93900 | medium | 6.4 | No | The Simple CAPTCHA with Cloudflare Turnstile plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' attribute of the... | 2026-11-04 |
| CVE-2026-93866 | not reported | — | No | An integer overflow vulnerability in the WebSocket connection handling used by WatchGuard Fireware OS's Access Portal allows a remote, unaut... | 2026-11-04 |
| CVE-2026-93434 | not reported | — | No | An XPath injection vulnerability in WatchGuard Fireware OS's SSH authentication process allows a remote, unauthenticated attacker with acces... | 2026-11-04 |
| CVE-2026-92377 | high | 7.8 | No | Improper access control in the Patch Management update mechanism of TeamViewer Full Client and Host for Windows prior to version 15.82 allow... | 2026-11-04 |
| CVE-2026-92376 | high | 7.8 | No | Improper authentication in the inter-process communication (IPC) mechanism of TeamViewer Remote Management Monitoring for Windows prior to v... | 2026-11-04 |
| CVE-2026-92375 | high | 7.8 | No | An improper access control vulnerability in the IPC communication between TeamViewer Full Client or Host prior to version 15.83 and the Remo... | 2026-11-04 |
| CVE-2026-92546 | high | 7.5 | No | Authentication bypass by spoofing vulnerability in Keepnet Labs Cybersecurity Inc. Agentic AI / Agentic Ally allows Authentication Bypass.... | 2026-11-04 |
| CVE-2026-82418 | critical | 9.8 | No | IBM Watson Speech Services Cartridge 4.0.0 through 5.4.0 could allow a remote attacker to execute arbitrary code due to a use-after-free vul... | 2026-11-04 |
| CVE-2026-88812 | high | 7.8 | No | A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached clients to cause a c... | 2026-11-04 |
| CVE-2026-87085 | medium | 6.3 | No | Tanium addressed a SQL injection vulnerability in Provision. | 2026-11-04 |
| CVE-2026-82984 | medium | 4.3 | No | When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team ("You are not a member o... | 2026-11-04 |
| CVE-2026-92374 | high | 7.8 | No | A time-of-check time-of-use (TOCTOU) race condition combined with improper symbolic link handling in the privileged helper of TeamViewer Ful... | 2026-11-04 |
| CVE-2026-92372 | high | 8.8 | No | An out-of-bounds write vulnerability in the screen-image decoder of TeamViewer Full Client for Linux and macOS prior to version 15.83 allows... | 2026-11-04 |
| CVE-2026-90464 | not reported | — | No | An external control of file path vulnerability in a WatchGuard Fireware OS firewall diagnostic command allows a remote, authenticated attack... | 2026-11-04 |