Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90933 | high | 7.1 | No | laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated... | 2026-09-23 |
| CVE-2026-90919 | critical | 9.8 | No | LightLLM through 1.2.0 contains a remote code execution vulnerability in the Config Server's unauthenticated /visual_register WebSocket endp... | 2026-09-23 |
| CVE-2026-90782 | medium | 5.3 | No | S2OPC through 1.7.3 contains a null pointer dereference in msg_subscription_publish_bs__alloc_notification_message_items() where a failed al... | 2026-09-23 |
| CVE-2026-90780 | high | 7.5 | No | SIPp through 3.7.7 contains a buffer overflow vulnerability in the get_header() function in src/sip_parser.cpp when processing SIP messages... | 2026-09-23 |
| CVE-2026-90779 | high | 7.5 | No | SIPp through 3.7.7 contains a stack buffer overflow vulnerability in createAuthHeader() when processing SIP authentication challenges with o... | 2026-09-23 |
| CVE-2026-90777 | high | 8.8 | No | ESPnet before 202609 deserializes pretrained model checkpoints using torch.load with weights_only=False, allowing arbitrary code execution f... | 2026-09-23 |
| CVE-2026-90770 | high | 8.8 | No | Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor address... | 2026-09-23 |
| CVE-2026-90767 | medium | 6.5 | No | Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arb... | 2026-09-23 |
| CVE-2026-90558 | critical | 9.8 | No | sngrep through 1.8.4 contains stack buffer overflow vulnerabilities in SIP attribute formatting routines when header values exceed the 255-b... | 2026-09-23 |
| CVE-2026-90556 | high | 7.8 | No | Freeciv versions before 3.2.6 contain a heap buffer overflow in worklist_load() when processing savegame files with declared worklist length... | 2026-09-23 |
| CVE-2026-90467 | medium | 4.0 | No | aiosmtplib before 5.1.3 fails to properly validate email addresses supplied by callers, allowing attackers to inject ESMTP parameters into M... | 2026-09-23 |
| CVE-2026-49439 | medium | 4.3 | No | OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with... | 2026-09-23 |
| CVE-2026-85676 | medium | 4.3 | No | Dub contains an open redirect vulnerability in the redir_url query parameter that is accepted on every short link without validation or doma... | 2026-09-23 |
| CVE-2026-85662 | medium | 5.3 | No | Marqo 2.26.0 contains a server-side request forgery vulnerability in the add_documents endpoint that allows unauthenticated attackers to tri... | 2026-09-23 |
| CVE-2026-89146 | high | 7.5 | No | libp2p-rendezvous through 0.17.1 fails to validate registration TTL values in discovery responses, allowing attackers to trigger timer arith... | 2026-09-23 |
| CVE-2026-85651 | high | 8.5 | No | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to... | 2026-09-23 |
| CVE-2026-85650 | medium | 5.4 | No | Trigger.dev before 4.5.2 contains a server-side request forgery vulnerability in webhook alert channel delivery URLs that are fetched withou... | 2026-09-23 |
| CVE-2026-85176 | high | 8.8 | No | DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via file... | 2026-09-23 |
| CVE-2026-82522 | medium | 5.4 | No | libjxl before 0.12 contains an integer underflow vulnerability in the container box parser that allows remote attackers to inject arbitrary... | 2026-09-23 |
| CVE-2026-84811 | medium | 6.5 | No | agentverus-scanner fails to analyze compiled Python bytecode files in companion code directories, allowing attackers to bypass security scan... | 2026-09-23 |