Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-11895 | medium | 6.4 | No | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-09-30 |
| CVE-2026-103389 | not reported | — | No | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was pers... | 2026-09-30 |
| CVE-2026-103388 | not reported | — | No | MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL valida... | 2026-09-30 |
| CVE-2026-103270 | high | 7.5 | No | LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated at... | 2026-09-30 |
| CVE-2026-102252 | not reported | — | No | A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows... | 2026-09-30 |
| CVE-2026-102371 | not reported | — | No | In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu P... | 2026-09-30 |
| CVE-2026-100871 | high | 8.8 | No | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate... | 2026-09-30 |
| CVE-2026-100870 | high | 8.8 | No | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header w... | 2026-09-30 |
| CVE-2026-100867 | low | 3.3 | No | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh p... | 2026-09-30 |
| CVE-2026-100863 | medium | 5.0 | No | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py i... | 2026-09-30 |
| CVE-2026-100862 | medium | 4.9 | No | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secr... | 2026-09-30 |
| CVE-2026-100859 | medium | 6.5 | No | Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators wi... | 2026-09-30 |
| CVE-2026-100858 | medium | 6.8 | No | heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issu... | 2026-09-30 |
| CVE-2026-100851 | high | 7.6 | No | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authent... | 2026-09-30 |
| CVE-2026-100850 | high | 7.7 | No | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backen... | 2026-09-30 |
| CVE-2026-100847 | high | 7.5 | No | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers... | 2026-09-30 |
| CVE-2026-100843 | high | 7.8 | No | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() de... | 2026-09-30 |
| CVE-2026-100835 | high | 7.4 | No | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correc... | 2026-09-30 |
| CVE-2026-100744 | high | 7.3 | No | A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpda... | 2026-09-30 |
| CVE-2026-100698 | medium | 5.8 | No | Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. Th... | 2026-09-30 |