Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92778 | medium | 5.4 | No | CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the featu... | 2026-09-23 |
| CVE-2026-92754 | medium | 4.3 | No | PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization deco... | 2026-09-23 |
| CVE-2026-92753 | high | 7.1 | No | PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filte... | 2026-09-23 |
| CVE-2026-92717 | critical | 9.1 | No | Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke Create... | 2026-09-23 |
| CVE-2026-92604 | high | 8.1 | No | Scirius through 3.8.0 contains an arbitrary file write vulnerability in the PCAP filestore upload endpoint that allows default User role use... | 2026-09-23 |
| CVE-2026-92601 | medium | 6.5 | No | Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and i... | 2026-09-23 |
| CVE-2026-92570 | medium | 6.5 | No | reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user... | 2026-09-23 |
| CVE-2026-95654 | high | 7.4 | No | Databasement before 1.7.14 validates invitation tokens only when the acceptance page loads, caching the authorization decision without re-ch... | 2026-09-23 |
| CVE-2026-92801 | high | 8.8 | No | cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. At... | 2026-09-23 |
| CVE-2026-92773 | high | 7.1 | No | Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organizati... | 2026-09-23 |
| CVE-2026-92771 | medium | 6.5 | No | Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users... | 2026-09-23 |
| CVE-2026-92761 | high | 8.8 | No | WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Att... | 2026-09-23 |
| CVE-2026-92760 | medium | 6.5 | No | Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr... | 2026-09-23 |
| CVE-2026-92752 | high | 8.3 | No | metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing re... | 2026-09-23 |
| CVE-2026-92751 | high | 8.1 | No | CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of... | 2026-09-23 |
| CVE-2026-92749 | high | 8.1 | No | SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to r... | 2026-09-23 |
| CVE-2026-92600 | medium | 6.5 | No | Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints o... | 2026-09-23 |
| CVE-2026-92568 | medium | 5.4 | No | MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users... | 2026-09-23 |
| CVE-2026-92566 | high | 8.2 | No | DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticate... | 2026-09-23 |
| CVE-2026-92565 | medium | 5.3 | No | Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee n... | 2026-09-23 |