Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102810 | high | 7.5 | No | Marmite through 0.4.2 contains a path traversal vulnerability in the development server started by --serve that allows unauthenticated attac... | 2026-09-30 |
| CVE-2026-77177 | critical | 9.8 | No | Open GenAI Stack (aka ogx-ai) 2026-06-11, as used in the Meta AI backend for WhatsApp and other products, allows code execution because prom... | 2026-09-30 |
| CVE-2023-54400 | critical | 9.8 | No | Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to... | 2026-09-30 |
| CVE-2026-102568 | medium | 5.5 | No | Pardus Parental Control before 0.7.0 contains an incorrect authorization vulnerability in the polkit policy that allows unprivileged local u... | 2026-09-30 |
| CVE-2015-20122 | high | 7.5 | No | Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of th... | 2026-09-30 |
| CVE-2026-102507 | medium | 5.7 | No | Sliver C2 framework version 1.7.7 and earlier contains an unhandled panic vulnerability in the operator gRPC handler that allows an attacker... | 2026-09-30 |
| CVE-2026-102422 | high | 8.1 | No | shell-quote's `quote()` function emits a `{ comment }` token as `#` followed by its text, which comments out the rest of the shell line, inc... | 2026-09-30 |
| CVE-2026-102414 | low | 3.7 | No | pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A... | 2026-09-30 |
| CVE-2026-102374 | medium | 6.1 | No | GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-enco... | 2026-09-30 |
| CVE-2026-102372 | medium | 6.1 | No | GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers t... | 2026-09-30 |
| CVE-2026-102367 | medium | 5.4 | No | mall4j through 4.0 contains an insufficient session expiration vulnerability in the token refresh endpoint that fails to validate the enable... | 2026-09-30 |
| CVE-2026-102366 | medium | 4.4 | No | mall4j through 4.0 contains an unrestricted file upload vulnerability in FileController endpoints that lack authorization checks and accept... | 2026-09-30 |
| CVE-2026-102364 | medium | 5.4 | No | mall4j through 4.0 fails to validate the sysType field in sa-token sessions, allowing storefront customers to authenticate as back-office us... | 2026-09-30 |
| CVE-2026-102363 | low | 3.7 | No | mall4j through 4.0 contains a missing authentication vulnerability in the DeliveryController checkDelivery endpoint that allows unauthentica... | 2026-09-30 |
| CVE-2026-102362 | medium | 5.3 | No | mall4j through 4.0 fails to implement authentication controls on the DELETE /prodComm endpoint in ProdCommController. Unauthenticated attack... | 2026-09-30 |
| CVE-2026-102333 | medium | 6.1 | No | httpdbg before 2.2.1 fails to validate URL schemes in recorded HTTP request URLs rendered as clickable links in the web interface. Attackers... | 2026-09-30 |
| CVE-2026-93348 | high | 8.1 | No | Unsloth Zoo versions 2025.9.9 before 2026.8.14, as implemented in Unsloth 2025.9.9 through 2026.8.19, contains a code injection vulnerabilit... | 2026-09-30 |
| CVE-2026-101061 | medium | 4.7 | No | utcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of C... | 2026-09-30 |
| CVE-2026-101060 | high | 8.2 | No | python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates... | 2026-09-30 |
| CVE-2026-101059 | high | 7.1 | No | utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect creden... | 2026-09-30 |