Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85620 | high | 8.6 | No | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes... | 2026-09-24 |
| CVE-2026-79787 | critical | 9.8 | No | Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers... | 2026-09-24 |
| CVE-2026-13249 | critical | 9.8 | No | An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industria... | 2026-09-24 |
| CVE-2026-13248 | high | 8.8 | No | An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web manag... | 2026-09-24 |
| CVE-2026-12559 | not reported | — | No | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Valida... | 2026-09-24 |
| CVE-2026-4638 | not reported | — | No | PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. I... | 2026-09-24 |
| CVE-2026-4637 | not reported | — | No | Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a reque... | 2026-09-24 |
| CVE-2026-96770 | not reported | — | No | All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClien... | 2026-09-24 |
| CVE-2026-91777 | high | 7.5 | No | Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference... | 2026-09-24 |
| CVE-2026-91776 | high | 7.5 | No | TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ... | 2026-09-24 |
| CVE-2026-89425 | high | 7.5 | No | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending J... | 2026-09-24 |
| CVE-2026-89030 | medium | 4.3 | No | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accoun... | 2026-09-24 |
| CVE-2023-54398 | critical | 9.8 | No | Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component tha... | 2026-09-24 |
| CVE-2026-91988 | high | 8.1 | No | atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the... | 2026-09-24 |
| CVE-2026-91997 | medium | 5.3 | No | evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allo... | 2026-09-24 |
| CVE-2026-91925 | high | 8.8 | No | Polyaxon through 2.16.4 renders operation specification fields with an unsandboxed Jinja2 environment during server-side run preparation, al... | 2026-09-24 |
| CVE-2026-91922 | medium | 6.1 | No | Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint t... | 2026-09-24 |
| CVE-2026-91079 | high | 8.5 | No | Huly Platform through 0.7.426 contains a server-side request forgery vulnerability in the print service due to missing hostname allowlist va... | 2026-09-24 |
| CVE-2026-90944 | high | 8.2 | No | Krayin CRM through 2.2.6 exposes the POST /admin/mail/inbound-parse endpoint without authentication, allowing unauthenticated attackers to i... | 2026-09-24 |
| CVE-2026-90943 | high | 8.7 | No | parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenti... | 2026-09-24 |