Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84810 | medium | 6.5 | No | claude-skill-antivirus fails to analyze executable files when scanning local skill directories, reading only SKILL.md while ignoring Python... | 2026-09-23 |
| CVE-2026-84485 | high | 7.5 | No | APITable through 1.13.0-beta.1 exposes the internal organization loadOrSearch endpoint without authentication, allowing unauthenticated atta... | 2026-09-23 |
| CVE-2026-84484 | high | 7.5 | No | ION-DTN versions before 4.2.0 contain an out-of-bounds read vulnerability in the decodeSdnv function that allows unauthenticated remote atta... | 2026-09-23 |
| CVE-2026-84699 | critical | 9.1 | No | Team Password Manager before 14.184.308 fails to enforce authentication requirements in the local account password reset flow. Unauthenticat... | 2026-09-23 |
| CVE-2026-95868 | medium | 6.3 | No | A weakness has been identified in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by th... | 2026-09-23 |
| CVE-2026-93769 | not reported | — | No | HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-admini... | 2026-09-23 |
| CVE-2026-95820 | medium | 6.3 | No | A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. Affected by this issue is s... | 2026-09-23 |
| CVE-2026-95831 | high | 7.8 | No | Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL. The gen... | 2026-09-23 |
| CVE-2026-93533 | medium | 6.3 | No | A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::ch... | 2026-09-23 |
| CVE-2026-93504 | medium | 6.3 | No | A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/[...path]/+server.ts of the compo... | 2026-09-23 |
| CVE-2026-92881 | medium | 4.3 | No | A security vulnerability has been detected in vgmstream. The affected element is the function init_vgmstream_awb_memory of the file src/meta... | 2026-09-23 |
| CVE-2026-61834 | medium | 4.3 | No | scim-patch is a library for applying SCIM patch operations. Prior to 0.9.2, navigate() reads inherited properties and assign() uses prototyp... | 2026-09-23 |
| CVE-2026-37603 | medium | 6.5 | No | Improper Restriction of Excessive Authentication Attempts in the administration login of pH7Software pH7Builder (pH7 Social Dating CMS) thro... | 2026-09-23 |
| CVE-2026-93616 | critical | 9.8 | Listed | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Poin... | 2026-09-23 |
| CVE-2026-54687 | critical | 9.8 | No | n8n-nodes-sqlite3 is a node for operating a local SQLite database from n8n. Prior to 1.0.0, nodes/SqliteNode/v1/SqliteV1.node.ts exposes the... | 2026-09-23 |
| CVE-2026-93342 | medium | 5.4 | No | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action... | 2026-09-23 |
| CVE-2026-94536 | medium | 4.3 | No | lamp-cloud through 5.10.0 fails to validate the employeeId parameter in the /anyone/visible/resource endpoint, allowing authenticated users... | 2026-09-23 |
| CVE-2026-93340 | medium | 6.8 | No | Gladys Assistant before 5.1.0 contains a password reset link poisoning vulnerability that allows unauthenticated remote attackers to obtain... | 2026-09-23 |
| CVE-2026-92419 | not reported | — | No | WEBCON BPS is vulnerable to Insecure Direct Object Reference (IDOR) in the /api/vacations/{path} endpoint. The selectedPeople parameter in t... | 2026-09-23 |
| CVE-2026-43641 | critical | 9.8 | No | Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an OS command injection vulnerability in the billing module handler that a... | 2026-09-23 |