Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-8304 | medium | 5.5 | No | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Co... | 2026-09-11 |
| CVE-2026-89261 | medium | 6.5 | No | MoguBlog through 6.2 exposes Elasticsearch index management endpoints in the mogu_search service without authentication, allowing remote att... | 2026-09-11 |
| CVE-2026-89256 | high | 8.7 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the Bookmark plugin w... | 2026-09-11 |
| CVE-2026-89241 | medium | 6.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePa... | 2026-09-11 |
| CVE-2026-89090 | medium | 5.9 | No | An unrecovered panic in the event stream header decoder in Amazon AWS SDK for Go v2 before release-2026-03-23 might allow an unauthenticated... | 2026-09-11 |
| CVE-2026-88938 | medium | 6.5 | No | knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read s... | 2026-09-11 |
| CVE-2026-88895 | high | 7.2 | No | CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using pa... | 2026-09-11 |
| CVE-2026-81908 | not reported | — | No | Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in c... | 2026-09-11 |
| CVE-2026-68528 | not reported | — | No | Concrete CMS RSS Displayer block below version 9.5.3 rendered remote feed item titles without HTML escaping, resulting in stored cross-site... | 2026-09-11 |
| CVE-2026-18122 | not reported | — | No | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS RE... | 2026-09-11 |
| CVE-2026-72992 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-77489 | high | 7.8 | No | Null pointer dereference in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-77906 | high | 8.8 | No | Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network. | 2026-09-11 |
| CVE-2026-78455 | medium | 4.3 | No | Out-of-bounds read in Xbox allows an unauthorized attacker to disclose information with a physical attack. | 2026-09-11 |
| CVE-2026-69727 | high | 8.0 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | 2026-09-11 |
| CVE-2026-70572 | high | 7.8 | No | Integer overflow or wraparound in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-72994 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-72997 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-73000 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-73015 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |