Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13260 | high | 7.5 | No | IBM Verify Identity Access could allow a remote attacker to cause a denial of service due to insufficient validation of incoming request res... | 2026-09-16 |
| CVE-2026-92216 | medium | 4.3 | No | A vulnerability was found in a2ui-project a2ui up to 0.10.7. Affected by this issue is the function openUrl of the file renderers/web_core/s... | 2026-09-16 |
| CVE-2026-92114 | medium | 5.3 | No | A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/ba... | 2026-09-16 |
| CVE-2026-78088 | high | 8.8 | No | The Contest Gallery – Upload & Vote Photos, Media, Sell with PayPal & Stripe plugin for WordPress is vulnerable to Unauthenticated Arbitrary... | 2026-09-16 |
| CVE-2026-76825 | high | 8.4 | No | RestrictedPython is a tool that helps define a subset of the Python language for accepting program input in a trusted environment. Prior to... | 2026-09-16 |
| CVE-2026-73444 | medium | 4.7 | No | On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker... | 2026-09-16 |
| CVE-2026-73438 | medium | 5.3 | No | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the sam... | 2026-09-16 |
| CVE-2026-5920 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_s... | 2026-09-16 |
| CVE-2026-27565 | critical | 9.8 | No | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell... | 2026-09-16 |
| CVE-2026-27564 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT reque... | 2026-09-16 |
| CVE-2026-27561 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET re... | 2026-09-16 |
| CVE-2026-27560 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE... | 2026-09-16 |
| CVE-2026-27559 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET req... | 2026-09-16 |
| CVE-2026-27556 | high | 8.8 | No | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using... | 2026-09-16 |
| CVE-2026-27555 | high | 8.8 | No | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a... | 2026-09-16 |
| CVE-2026-27554 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using op... | 2026-09-16 |
| CVE-2026-27551 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user cr... | 2026-09-16 |
| CVE-2026-27550 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials... | 2026-09-16 |
| CVE-2026-27549 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint usi... | 2026-09-16 |
| CVE-2026-27546 | critical | 9.8 | No | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accoun... | 2026-09-16 |