Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92462 | medium | 6.5 | No | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated b... | 2026-09-24 |
| CVE-2026-92257 | medium | 5.4 | No | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in L7 content management pages that use eval() sinks... | 2026-09-24 |
| CVE-2026-92255 | medium | 5.4 | No | Netcore NR255-V version 1.5.130703 contains an out-of-bounds read vulnerability in filter_arp_put_file.cgi caused by improper use of a strin... | 2026-09-24 |
| CVE-2026-92000 | high | 7.5 | No | adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attack... | 2026-09-24 |
| CVE-2026-89027 | medium | 6.5 | No | miniOrange JWT Authentication for WP REST APIs plugin for WordPress before 4.8.0 contains an authentication method downgrade vulnerability t... | 2026-09-24 |
| CVE-2026-89026 | critical | 9.8 | No | The Issabel Framework, the web framework supporting Issabel PBX software, before commit b97dbaf contains a hard-coded HS256 JWT signing key... | 2026-09-24 |
| CVE-2026-91989 | high | 7.5 | No | atomic-agents-stack before 1.1.0 contains a path traversal vulnerability in the dashboard HTTP server that allows remote attackers to read a... | 2026-09-24 |
| CVE-2026-91995 | critical | 9.1 | No | pig before 4.1.0 contains an authentication bypass vulnerability in the /register/password endpoint where password verification results are... | 2026-09-24 |
| CVE-2026-91923 | high | 7.7 | No | KubeSphere through 4.1.3 contains a server-side request forgery vulnerability in the git credential verification endpoint that accepts unval... | 2026-09-24 |
| CVE-2026-91144 | high | 7.5 | No | ZFile through 5.0.5 fails to validate requested file paths against a share link's allowed entries on the download endpoint. Attackers holdin... | 2026-09-24 |
| CVE-2026-89266 | high | 8.2 | No | stb_vorbis through 1.22 contains a heap buffer overflow in start_decoder() where the codebook multiplicands allocation size is truncated fro... | 2026-09-24 |
| CVE-2026-86124 | critical | 9.8 | No | AutoAgent contains an unauthenticated remote code execution vulnerability in the TCP server that binds to all interfaces and executes attack... | 2026-09-24 |
| CVE-2026-86119 | high | 8.6 | No | Webstudio through 0.296.0 contains an unauthenticated server-side request forgery vulnerability in the /cgi/image, /cgi/video, and /cgi/asse... | 2026-09-24 |
| CVE-2026-85178 | high | 7.7 | No | Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the reque... | 2026-09-24 |
| CVE-2026-88384 | medium | 5.5 | No | OpenEXR 3.4.14 contains a NULL Pointer Dereference in the C++ attribute parsing path. A specially crafted EXR file containing an unknown-typ... | 2026-09-24 |
| CVE-2026-90481 | not reported | — | No | In PortSwigger Burp Suite DAST (formerly Burp Suite Enterprise Edition) before 2026.8, an authentication bypass can occur via an alternate p... | 2026-09-24 |
| CVE-2026-79680 | not reported | — | No | Authentication bypass vulnerability in the password authentication mechanism of the Qt VNC Server module. An attacker using a specially modi... | 2026-09-24 |
| CVE-2026-11744 | not reported | — | No | An input validation vulnerability exists in the PaperCut Hive embedded application for Ricoh devices. The application fails to properly sani... | 2026-09-24 |
| CVE-2026-79310 | high | 8.5 | No | webpy web.py 0.76 is vulnerable to server-side template injection (SSTI). The template engine can be tricked into executing attacker-control... | 2026-09-24 |
| CVE-2026-78253 | not reported | — | No | Uncontrolled recursion in QXmlStreamReader::readElementText() in Qt Group Qt allows attackers to cause a denial of service (application cras... | 2026-09-24 |