Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-99259 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra d... | 2026-11-03 |
| CVE-2026-99258 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()... | 2026-11-03 |
| CVE-2026-99257 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We us... | 2026-11-03 |
| CVE-2026-99256 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rw_se... | 2026-11-03 |
| CVE-2026-99251 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: Avoid infinite retry loop in init_vp_index() There is a r... | 2026-11-03 |
| CVE-2026-99250 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: printk: Postpone kthread startup There have been various bug reports r... | 2026-11-03 |
| CVE-2026-99249 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of... | 2026-11-03 |
| CVE-2026-99248 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: i2c: xiic: restore non-managed runtime PM to fix clk WARN flood The de... | 2026-11-03 |
| CVE-2026-99247 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: tracing: Do not initialize tracefs work if tracing is disabled If trac... | 2026-11-03 |
| CVE-2026-116680 | medium | 6.4 | No | HomeBox is a home inventory and organization system. Prior to version 0.27.0, Homebox validates generic notifier URLs with ValidateNotifierU... | 2026-11-03 |
| CVE-2026-116676 | high | 8.8 | No | Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, A... | 2026-11-03 |
| CVE-2026-110972 | not reported | — | No | Płatnik performs client-side authentication. An attacker with access to any application instance connected to the backend server can bypass... | 2026-11-03 |
| CVE-2026-110971 | not reported | — | No | Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue w... | 2026-11-03 |
| CVE-2026-110970 | not reported | — | No | Płatnik uses HTTP protocol to download updates, libraries and support files. It allows an attacker to conduct a Man-In-The-Middle attack, ob... | 2026-11-03 |
| CVE-2026-42012 | high | 7.1 | No | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains U... | 2026-11-03 |
| CVE-2026-86473 | critical | 9.1 | No | Apache Airflow: the Core API logout endpoint revokes only a session token presented as the _token cookie. When a client logs out presenting... | 2026-11-03 |
| CVE-2026-82355 | medium | 4.2 | No | When a request to the Airflow core API carries both a session cookie and an explicit `Authorization: Bearer` token, Airflow resolves the cal... | 2026-11-03 |
| CVE-2026-75158 | medium | 4.3 | No | Apache Airflow's `/assets/events` API returned asset events for every Dag in the deployment, with no filter restricting them to the Dags the... | 2026-11-03 |
| CVE-2026-75157 | high | 7.5 | No | Apache Airflow's asset queued-events DELETE endpoints checked the caller's Dag-axis permission with `READ` instead of `EDIT`. Any authentica... | 2026-11-03 |
| CVE-2026-68971 | medium | 6.5 | No | Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_un... | 2026-11-03 |