Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100371 | not reported | — | No | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard... | 2026-09-30 |
| CVE-2026-100370 | medium | 4.7 | No | DOMSanitizer is a DOM/SVG/MathML Sanitizer for PHP 7.3+. Prior to version 1.0.15, the isDangerousUrl() method is responsible for rejecting d... | 2026-09-30 |
| CVE-2026-101914 | medium | 6.5 | No | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.1 and 1.14.1, the exact pat... | 2026-09-30 |
| CVE-2026-84894 | high | 7.5 | No | In moxygen before commit 004123dd24c3, MoQSession::dataStreamReadLoop keeps using a stream read handle after reading a FIN, which invalidate... | 2026-09-30 |
| CVE-2026-55160 | high | 7.6 | No | Stringer is a self-hosted, anti-social RSS reader. Prior to commit 75cb095, an unrestricted Server-Side Request Forgery (SSRF) vulnerability... | 2026-09-30 |
| CVE-2026-55156 | medium | 5.3 | No | Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI cli... | 2026-09-30 |
| CVE-2026-49994 | critical | 9.1 | No | Bluehood monitors local bluetooth activity. Prior to version 0.7.1, when auth_enabled is set in Bluehood, only the HTML page handlers enforc... | 2026-09-30 |
| CVE-2026-101913 | not reported | — | No | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.5.1, the Address6 isLinkLocal method... | 2026-09-30 |
| CVE-2026-101912 | not reported | — | No | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the isInSubnet and isHostInSubn... | 2026-09-30 |
| CVE-2026-101910 | not reported | — | No | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. From 10.2.0 until 10.5.1, the Address6 isPrivate... | 2026-09-30 |
| CVE-2026-48100 | not reported | — | No | Payy is an Ethereum L2 zk-rollup for privacy preserving and regulatory compliant transactions. Prior to version 1.3.0, agg_agg forwards the... | 2026-09-30 |
| CVE-2026-96538 | not reported | — | No | WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file fun... | 2026-09-30 |
| CVE-2026-57443 | high | 7.5 | No | SCBE-AETHERMOORE is a geometric AI governance and evaluation framework. Starting in version 4.0.2 and prior to version 4.2.1, the AetherBrow... | 2026-09-30 |
| CVE-2026-100369 | high | 8.4 | No | CliInvoke and its formerly named `AlastairLundy.CliInvoke` package are .NET libraries for invoking command-line programs and wrapping execut... | 2026-09-30 |
| CVE-2026-100368 | high | 8.4 | No | CliInvoke is a .NET library for invoking command-line programs, and its `CliInvoke.Specializations` packages provide specialized wrappers fo... | 2026-09-30 |
| CVE-2026-91841 | high | 7.8 | No | A flaw was found in NetworkManager-vpnc, a VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by inject... | 2026-09-30 |
| CVE-2026-91840 | high | 7.8 | No | A flaw was found in NetworkManager-vpnc. This vulnerability allows a local unprivileged user to escalate privileges to root. By injecting a... | 2026-09-30 |
| CVE-2026-91839 | high | 7.8 | No | A flaw was found in NetworkManager-fortisslvpn, the FortiSSLVPN plugin for NetworkManager. The nm-fortisslvpn-service improperly handles car... | 2026-09-30 |
| CVE-2026-91838 | high | 7.8 | No | A flaw was found in NetworkManager-sstp, the SSTP VPN plugin for NetworkManager. A local unprivileged user can exploit this vulnerability by... | 2026-09-30 |
| CVE-2026-91837 | high | 7.8 | No | A flaw was found in NetworkManager-iodine, the iodine VPN plugin for NetworkManager. A local unprivileged user can exploit a vulnerability i... | 2026-09-30 |