Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-71537 | medium | 6.5 | No | Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::... | 2026-09-24 |
| CVE-2026-69190 | medium | 6.3 | No | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and da... | 2026-09-24 |
| CVE-2026-55870 | not reported | — | No | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portio... | 2026-09-24 |
| CVE-2026-55071 | high | 8.4 | No | MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_in... | 2026-09-24 |
| CVE-2026-55060 | low | 3.7 | No | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended admin... | 2026-09-24 |
| CVE-2026-52742 | not reported | — | No | GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configu... | 2026-09-24 |
| CVE-2026-52740 | not reported | — | No | GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when... | 2026-09-24 |
| CVE-2026-61552 | high | 7.2 | No | Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled temp... | 2026-09-24 |
| CVE-2026-61551 | high | 8.6 | No | Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack bec... | 2026-09-24 |
| CVE-2026-61550 | critical | 9.8 | No | Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does n... | 2026-09-24 |
| CVE-2026-53534 | not reported | — | No | JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP serv... | 2026-09-24 |
| CVE-2026-68956 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node... | 2026-09-24 |
| CVE-2026-65634 | not reported | — | No | Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial... | 2026-09-24 |
| CVE-2026-61822 | medium | 6.5 | No | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions out... | 2026-09-24 |
| CVE-2026-54647 | high | 7.2 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-con... | 2026-09-24 |
| CVE-2026-54642 | not reported | — | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action... | 2026-09-24 |
| CVE-2026-54580 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal... | 2026-09-24 |
| CVE-2026-54579 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp... | 2026-09-24 |
| CVE-2026-54577 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_a... | 2026-09-24 |
| CVE-2026-87900 | not reported | — | No | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a... | 2026-09-24 |