Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91819 | not reported | — | No | Affected versions of MISP rely on CakePHP request-method override processing in a way that can disable CSRF and form-security validation. C... | 2026-09-16 |
| CVE-2026-76081 | medium | 5.5 | No | ZITADEL is an open source identity management platform. Prior to version 4.16.0, a bug in how ZITADEL updates permissions when multiple proj... | 2026-09-16 |
| CVE-2026-65838 | high | 8.2 | No | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/ope... | 2026-09-16 |
| CVE-2026-54246 | medium | 5.7 | No | Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.13, the routesrv component serves cluster-wide control-pl... | 2026-09-16 |
| CVE-2026-91021 | medium | 5.4 | No | Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView no... | 2026-09-16 |
| CVE-2026-55416 | high | 8.8 | No | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.19, 12.3.10, and 2026.1.6, an authenticated user with reports... | 2026-09-16 |
| CVE-2026-55072 | high | 8.5 | No | Pimcore is an Open Source Data & Experience Management Platform. Prior to 2026.1.5, an authenticated user with the objects permission can su... | 2026-09-16 |
| CVE-2026-57131 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under... | 2026-09-16 |
| CVE-2026-57127 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. Prior to 4.6.58, recipe serve installs APIKeyAuthMiddleware or JWTAuthMiddleware when an operator s... | 2026-09-16 |
| CVE-2026-56839 | high | 7.3 | No | PraisonAI is a multi-agent teams system. Prior to 4.6.59, the CODE_TOOLS wrappers keep _workspace_root as None and pass workspace=None to re... | 2026-09-16 |
| CVE-2026-57128 | medium | 4.3 | No | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, the SSE server in src/praisonai-agents/praisonaiagents/server/serv... | 2026-09-16 |
| CVE-2026-90961 | not reported | — | No | The LdapAuth and LinOTPAuth authentication plugins in MISP contain an authentication bypass vulnerability. Both LdapAuthenticate and LinOTPA... | 2026-09-16 |
| CVE-2026-90957 | not reported | — | No | Affected versions of MISP serve uploaded SVG images inline without a restrictive browser sandbox. The commit explains that SVG files are XM... | 2026-09-16 |
| CVE-2026-90955 | not reported | — | No | Affected versions of MISP’s interactive CLI shell do not reliably preserve the identity of the impersonated MISP user across audit logging.... | 2026-09-16 |
| CVE-2026-90895 | not reported | — | No | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several au... | 2026-09-16 |
| CVE-2026-90893 | not reported | — | No | MISP contains a Cross-Site Request Forgery (CSRF) vulnerability in the UserSettingsController. The actions setTheme, setHomePage, and eventI... | 2026-09-16 |
| CVE-2026-29812 | medium | 4.3 | No | CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. | 2026-09-16 |
| CVE-2026-29810 | medium | 4.3 | No | CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. | 2026-09-16 |
| CVE-2026-86118 | medium | 4.3 | No | gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger... | 2026-09-16 |
| CVE-2026-49838 | medium | 5.9 | No | GoBGP is an open source Border Gateway Protocol (BGP) implementation in the Go Programming Language. Prior to version 4.7.0, GoBGP accepts a... | 2026-09-16 |