Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73165 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73164 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73163 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-19535 | not reported | — | No | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advan... | 2026-09-23 |
| CVE-2026-92465 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL... | 2026-09-23 |
| CVE-2026-92461 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any lo... | 2026-09-23 |
| CVE-2026-92460 | medium | 6.5 | No | yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-o... | 2026-09-23 |
| CVE-2026-92458 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticate... | 2026-09-23 |
| CVE-2026-92457 | medium | 6.5 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authent... | 2026-09-23 |
| CVE-2026-92456 | high | 7.1 | No | yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any... | 2026-09-23 |
| CVE-2026-92455 | medium | 4.3 | No | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenti... | 2026-09-23 |
| CVE-2026-86516 | medium | 4.7 | No | A vulnerability was detected in elenavanengelenmaslova mocknest-serverless 0.9.0. The affected element is an unknown function of the file de... | 2026-09-23 |
| CVE-2026-13745 | not reported | — | No | A vulnerability in the Gemini CLI prior to version 0.39.1 allows attackers to achieve arbitrary code execution by tricking a victim into sta... | 2026-09-23 |
| CVE-2000-0944 | critical | 9.8 | No | CGI Script Center News Update 1.1 does not properly validate the original news administration password during a password change operation, w... | 2026-09-23 |
| CVE-2026-73176 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-84835 | medium | 5.3 | No | Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.... | 2026-09-23 |
| CVE-2026-6285 | high | 7.5 | No | Weak Password Recovery Mechanism for Forgotten Password vulnerability in Ankaref Innovation and Technology Inc. LIBRID/LIBREF allows Passwor... | 2026-09-23 |
| CVE-2026-84217 | medium | 5.4 | No | Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Cons... | 2026-09-23 |
| CVE-2026-12683 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.... | 2026-09-23 |
| CVE-2026-12682 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ankaref Innovation and Technology Inc.... | 2026-09-23 |