Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-81356 | high | 8.2 | No | Inconsistent interpretation of http requests ('http request/response smuggling') in Visual Studio Code allows an unauthorized attacker to by... | 2026-09-11 |
| CVE-2026-81357 | high | 8.2 | No | Server-side request forgery (ssrf) in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-81376 | critical | 9.6 | No | Incomplete comparison with missing factors in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network... | 2026-09-11 |
| CVE-2026-81377 | medium | 6.5 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to perf... | 2026-09-11 |
| CVE-2026-84652 | high | 7.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, Jenkins does not rotate the session when a user is authenticated via the "remember me... | 2026-09-11 |
| CVE-2026-81378 | high | 8.2 | No | Interpretation conflict in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-81379 | high | 8.2 | No | Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network. | 2026-09-11 |
| CVE-2026-73310 | medium | 5.9 | No | XenForo before 2.3.13 contains an authorization flaw in the OAuth2 token endpoint that allows attackers controlling any allowlisted redirect... | 2026-09-11 |
| CVE-2026-73309 | critical | 9.1 | No | XenForo before 2.3.13 contains an authentication bypass vulnerability in the OAuth2 token endpoint that allows unauthenticated attackers to... | 2026-09-11 |
| CVE-2026-73316 | high | 7.5 | No | XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same... | 2026-09-11 |
| CVE-2026-73315 | high | 8.6 | No | XenForo before 2.3.13 contains a server-side request forgery vulnerability in the PayPal REST webhook handler that allows unauthenticated at... | 2026-09-11 |
| CVE-2026-73314 | high | 7.5 | No | XenForo before 2.3.13 contains a signature verification logic error in the PayPal REST webhook handler that allows unauthenticated attackers... | 2026-09-11 |
| CVE-2026-73312 | high | 7.4 | No | XenForo before 2.3.13 contains a refresh token replay vulnerability that allows attackers to reuse a refresh token multiple times by exploit... | 2026-09-11 |
| CVE-2026-73311 | high | 7.4 | No | XenForo before 2.3.13 contains an OAuth2 authorization code reuse vulnerability that allows attackers to obtain unauthorized token pairs by... | 2026-09-11 |
| CVE-2026-74239 | high | 7.2 | No | XenForo before 2.3.13 contains a path traversal vulnerability in the style archive importer on Windows deployments that allows authenticated... | 2026-09-11 |
| CVE-2026-73321 | medium | 6.5 | No | XenForo before 2.3.13 contains an uncontrolled recursion vulnerability in the BBCode parser that allows authenticated attackers to cause per... | 2026-09-11 |
| CVE-2026-73320 | medium | 6.1 | No | XenForo before 2.3.13 contains an unauthenticated information disclosure vulnerability that allows unauthenticated attackers to retrieve pri... | 2026-09-11 |
| CVE-2026-73319 | medium | 6.1 | No | XenForo before 2.3.13 contains a cross-site scripting vulnerability in the dynamic redirect handler that allows unauthenticated attackers to... | 2026-09-11 |
| CVE-2026-73317 | low | 2.7 | No | XenForo before 2.3.13 contains a missing authorization vulnerability in the ACP cache-rebuild dispatcher that allows limited administrators... | 2026-09-11 |
| CVE-2026-9160 | medium | 4.3 | No | Improper neutralization of special elements used in a template engine vulnerability in Arma Digital Media Inc. Website Template allows Code... | 2026-09-11 |