Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104908 | not reported | — | No | MISP contains an improper input validation vulnerability in the decaying model import functionality. The import endpoint was intended to cre... | 2026-10-02 |
| CVE-2026-104907 | not reported | — | No | MISP contains a cross-site scripting (XSS) vulnerability in the remote event preview page. When a linked (remote) MISP server is configured,... | 2026-10-02 |
| CVE-2026-104906 | not reported | — | No | MISP contains a cross-site scripting (XSS) vulnerability in the TAXII object viewer. When displaying a remote TAXII object, the JSON content... | 2026-10-02 |
| CVE-2026-104901 | not reported | — | No | MISP contains a cross-site scripting (XSS) vulnerability in the ID Translator feature. When a user views the ID Translator page, the applica... | 2026-10-02 |
| CVE-2026-104900 | not reported | — | No | MISP contains a stored cross-site scripting (XSS) vulnerability in the index table rendering of the remote event preview. The count field te... | 2026-10-02 |
| CVE-2026-103473 | high | 8.1 | No | Deno versions 2.7.0 through 2.9.7 on Windows contain a command injection vulnerability in node:child_process where shell arguments are escap... | 2026-10-02 |
| CVE-2026-103436 | low | 3.7 | No | apcupsd through 3.14.14 discloses uninitialized stack memory in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi, and u... | 2026-10-02 |
| CVE-2026-103397 | medium | 5.6 | No | OpenSave before 2.4.0-beta.1 fails to validate sender identity in WAN relay requests, allowing unpaired room members to impersonate paired d... | 2026-10-02 |
| CVE-2026-103243 | medium | 5.8 | No | LightLLM through 1.2.0 fails to validate image_url and audio_url parameters in multimodal endpoints, allowing unauthenticated attackers to p... | 2026-10-02 |
| CVE-2026-103231 | high | 7.3 | No | A vulnerability was identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. The affected e... | 2026-10-02 |
| CVE-2026-103227 | medium | 6.3 | No | A weakness has been identified in GPAC up to 26.07.0. Affected by this issue is the function gf_dash_resolve_url of the file src/media_tools... | 2026-10-02 |
| CVE-2026-103118 | medium | 4.3 | No | A vulnerability was detected in GraphicsMagick up to 1.3.47. Affected by this vulnerability is the function ExtractPostscript of the file co... | 2026-10-02 |
| CVE-2026-103115 | medium | 6.3 | No | A security flaw has been discovered in OS4ED openSIS-Classic up to 9.3. This affects an unknown function of the file functions/CustomFieldsF... | 2026-10-02 |
| CVE-2026-101883 | medium | 5.4 | No | OpenClaw Windows Node through 2026.9.4 contains a server-side request forgery vulnerability in the canvas.present capability that bypasses U... | 2026-10-02 |
| CVE-2026-101879 | medium | 6.5 | No | OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected... | 2026-10-02 |
| CVE-2023-54403 | high | 7.5 | No | Yonyou U8 CRM before V16.5 and V18 contains an arbitrary file read vulnerability in /ajax/getemaildata.php that allows unauthenticated attac... | 2026-10-02 |
| CVE-2026-100264 | low | 2.7 | No | In JetBrains YouTrack before 2026.2.18991 stored SMTP server credentials could be disclosed by changing the server host | 2026-10-02 |
| CVE-2026-100265 | medium | 6.5 | No | In JetBrains Rider before 2026.2.1 aI Assistant could auto-update third-party skills without user confirmation | 2026-10-02 |
| CVE-2026-100266 | medium | 6.5 | No | In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted ad... | 2026-10-02 |
| CVE-2026-100270 | low | 2.7 | No | In JetBrains YouTrack before 2026.2.19197 low-level Admin Read permission users could disclose integration credentials via import configurat... | 2026-10-02 |