Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101045 | high | 8.0 | No | Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask metadata. In manifests generated before 2026-0... | 2026-09-30 |
| CVE-2026-100717 | critical | 9.9 | No | froxlor is a server administration panel. In versions 2.3.10 and earlier, Validate::validateUrl rejects carriage return and line feed charac... | 2026-09-30 |
| CVE-2026-100697 | high | 8.6 | No | Adminer 6.0.0 through 6.0.1, when the official ClickHouse driver plugin (plugins/drivers/clickhouse.php, rewritten in 6.0.0) is loaded, is v... | 2026-09-30 |
| CVE-2026-100693 | high | 8.4 | No | Hugo versions from v0.162.0 before v0.166.0 contain a case-sensitive validation flaw in the security.http.urls IP-literal deny rule that all... | 2026-09-30 |
| CVE-2026-100689 | medium | 5.9 | No | GitPython before 3.1.62 does not validate the `path` field read from an untrusted .gitmodules file when updating submodules. While a prior f... | 2026-09-30 |
| CVE-2026-100677 | medium | 5.3 | No | stoatchat before 0.15.5 contains an account enumeration vulnerability in the login endpoint that exposes source file locations in error resp... | 2026-09-30 |
| CVE-2026-100627 | high | 8.1 | No | Capgo (Cap-go/capgo.app) server backend Supabase functions contain an incorrect authorization flaw in the API-key bundle promotion path. The... | 2026-09-30 |
| CVE-2026-100625 | high | 7.1 | No | Capgo (capgo.app) exposes a native build TUS upload proxy (supabase/functions/_backend/public/build/upload.ts) that authorizes a caller agai... | 2026-09-30 |
| CVE-2026-100623 | high | 8.8 | No | Capgo (capgo.app) exposes the legacy membership table public.org_users directly through Supabase PostgREST. The table's row-level security p... | 2026-09-30 |
| CVE-2026-100621 | medium | 4.3 | No | Capgo (capgo.app) contains an incomplete access-control/content-lock enforcement issue affecting all versions; no patch is available at the... | 2026-09-30 |
| CVE-2026-100619 | high | 8.8 | No | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restricti... | 2026-09-30 |
| CVE-2026-100618 | high | 8.5 | No | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `ico... | 2026-09-30 |
| CVE-2026-100617 | high | 8.8 | No | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/or... | 2026-09-30 |
| CVE-2026-100613 | medium | 5.3 | No | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch ava... | 2026-09-30 |
| CVE-2026-100611 | medium | 6.5 | No | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly creat... | 2026-09-30 |
| CVE-2026-100387 | high | 8.1 | No | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticat... | 2026-09-30 |
| CVE-2026-100306 | medium | 5.3 | No | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote u... | 2026-09-30 |
| CVE-2023-53899 | critical | 9.8 | No | PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload... | 2026-09-30 |
| CVE-2026-69271 | high | 8.0 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 2026-09-30 |
| CVE-2026-69269 | high | 7.8 | No | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |