Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101057 | low | 3.1 | No | utcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServ... | 2026-09-30 |
| CVE-2026-101032 | high | 7.0 | No | navi through 2.24.0 fails to properly escape cheatsheet variable values when substituting them into shell commands. Attackers can inject she... | 2026-09-30 |
| CVE-2026-100866 | low | 3.3 | No | onefetch through 2.28.1 writes repository information field values to the terminal without removing control characters, allowing terminal es... | 2026-09-30 |
| CVE-2026-100837 | low | 3.7 | No | Contrast (Edgeless Systems) through 1.20.0 performs unanchored suffix matching when selecting per-registry configuration in the imagepuller.... | 2026-09-30 |
| CVE-2026-100520 | high | 8.8 | No | Laranode versions before 1.2.1 contain a path traversal vulnerability in the POST /filemanager/upload-file endpoint that allows authenticate... | 2026-09-30 |
| CVE-2026-100390 | high | 7.4 | No | Zoraxy versions 3.2.3 through 3.3.4 fail to properly parse IPv6 addresses in the RemoteAddr field when setting forwarded headers. Unauthenti... | 2026-09-30 |
| CVE-2026-100389 | high | 8.1 | No | GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to... | 2026-09-30 |
| CVE-2026-100248 | not reported | — | No | The Rattadan Cosmowarp smart contract before 56c6147 can have a comparison to an unintended value of current_admin. | 2026-09-30 |
| CVE-2026-100230 | medium | 5.3 | No | Input Leap (aka input-leap) through 3.0.3, when the non-default --enable-drag-drop option is used on Windows or macOS, mishandles the / vers... | 2026-09-30 |
| CVE-2026-88389 | medium | 6.2 | No | Espruino 2v29 (commit bffc6d0) contains a NULL pointer dereference vulnerability in jslGetRawString() in src/jslex.c. Crafted raw/binary str... | 2026-09-30 |
| CVE-2026-88421 | high | 7.5 | No | Incorrect access control in the BlogPage.get_entries() component of APSL puput v1.2.1 through v2.2.0 allows unauthenticated attackers to vie... | 2026-09-30 |
| CVE-2026-88420 | medium | 5.4 | No | A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authen... | 2026-09-30 |
| CVE-2026-79153 | high | 7.8 | No | Seclore FileSecure Desktop Client before 3.25.1.0 contains improper access control vulnerability in the kernel-mode driver component that al... | 2026-09-30 |
| CVE-2026-52622 | high | 7.5 | No | An issue in Wellav Technologies Co., Ltd Wellav WES Emergency Broadcast Terminal WES100, WES270, WES280, and WES290 before 08-08-2023 allows... | 2026-09-30 |
| CVE-2026-97875 | high | 8.1 | No | Rojo's "rojo serve" HTTP API (default port 34872) has no Host/Origin header validation, making it vulnerable to DNS rebinding. A malicious w... | 2026-09-30 |
| CVE-2026-27867 | not reported | — | No | An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat (in this case, registration action is required) who h... | 2026-09-30 |
| CVE-2026-97764 | low | 3.7 | No | django-allauth before 65.19.4 does not have the expected limits on failed login attempts because, in some common configurations, an attacker... | 2026-09-30 |
| CVE-2026-97737 | high | 7.4 | No | In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeove... | 2026-09-30 |
| CVE-2026-97736 | medium | 5.4 | No | tinyauth before 5.1.3 allows rule bypass by appending an allowed route string. This is caused by an unanchored regular expression. | 2026-09-30 |
| CVE-2026-97735 | high | 8.0 | No | ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over... | 2026-09-30 |