Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87859 | medium | 5.3 | No | morgan is an HTTP request logger middleware for Node.js. In versions before 1.12.1, its escapeLogField() function does not escape the double... | 2026-09-16 |
| CVE-2026-87123 | medium | 5.9 | No | hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helpe... | 2026-09-16 |
| CVE-2026-87908 | high | 7.5 | No | multiparty is a Node.js library for parsing multipart/form-data request bodies. In versions from 2.1.0 up to but not including 4.3.1, the pa... | 2026-09-16 |
| CVE-2026-43741 | medium | 5.5 | No | A logic issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.... | 2026-09-16 |
| CVE-2026-75624 | high | 8.8 | No | IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.27 could allow a remote authenticated attacker to bypass... | 2026-09-16 |
| CVE-2026-78135 | high | 7.3 | No | libcharon in strongSwan 5.9.7 through 6.0.7 mishandles behavioral workflow in the IKEv2 state machine. Because CREATE_CHILD_SA requests are... | 2026-09-16 |
| CVE-2023-37253 | low | 3.1 | No | An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppressed user via the AP... | 2026-09-16 |
| CVE-2023-37252 | low | 3.1 | No | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames that have been hidden. | 2026-09-16 |
| CVE-2026-89172 | not reported | — | No | Improper protection of physical side channels vulnerability in Microchip AN1044, Microchip AN953, and Microchip SW300052. This issue affect... | 2026-09-16 |
| CVE-2026-82191 | not reported | — | No | Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0... | 2026-09-16 |
| CVE-2026-82190 | not reported | — | No | Joomla Extension - j2commerce.com - Predictable/forgeable order access token in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Anyone who... | 2026-09-16 |
| CVE-2026-82189 | not reported | — | No | Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthentic... | 2026-09-16 |
| CVE-2026-81568 | not reported | — | No | Joomla Extension - j2commerce.com - Arbitrary file read via `task=download` in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - `J2StoreMode... | 2026-09-16 |
| CVE-2026-81567 | not reported | — | No | Joomla Extension - j2commerce.com - Unauthenticated blind SQL injection in the storefront product list in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22,... | 2026-09-16 |
| CVE-2026-78081 | not reported | — | No | Joomla Extension - j2commerce.com - Missing CSRF protection on cart, checkout and myprofile controllers in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22... | 2026-09-16 |
| CVE-2026-81566 | not reported | — | No | Joomla Extension - joomshaper.com - Missing Access Control in Menu Item Creation in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The add-t... | 2026-09-16 |
| CVE-2026-81565 | not reported | — | No | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Upload in SP Page Builder (Free and Pro) 4.0.0 - 6.9.0 - The fold... | 2026-09-16 |
| CVE-2026-81564 | not reported | — | No | Joomla Extension - joomshaper.com - Missing Directory Confinement in Media Rename Allowing Arbitrary File Rename in SP Page Builder (Free an... | 2026-09-16 |
| CVE-2026-79700 | not reported | — | No | Joomla Extension - joomshaper.com - Unauthenticated CAPTCHA Bypass via Request-Controlled CAPTCHA Configuration in SP Page Builder Pro 5.1.4... | 2026-09-16 |
| CVE-2026-78375 | not reported | — | No | Joomla Extension - joomshaper.com - Authenticated Privileged SQL Injection in the Content Plugin of SP Page Builder (Free and Pro) 5.2.1 - 6... | 2026-09-16 |