Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89065 | high | 7.1 | No | Relative path traversal in the generated file manifest cleanup component in projen before 0.101.37 might allow context-dependent attackers t... | 2026-09-11 |
| CVE-2026-84390 | critical | 9.8 | No | A inclusion of sensitive information in source code vulnerability in Fortinet FortiMonitorOnSight 7.2.4 through 7.2.7, FortiMonitorOnSight 7... | 2026-09-11 |
| CVE-2026-81909 | not reported | — | No | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backe... | 2026-09-11 |
| CVE-2026-86080 | medium | 5.3 | No | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but... | 2026-09-11 |
| CVE-2026-86079 | medium | 6.5 | No | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes inter... | 2026-09-11 |
| CVE-2026-86078 | medium | 6.5 | No | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI workflow summary used node names and connect... | 2026-09-11 |
| CVE-2026-86076 | high | 8.8 | No | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the expression compiler sanitizer resolved throug... | 2026-09-11 |
| CVE-2026-86075 | high | 7.5 | No | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the OAuth Dynamic Client Registration endpoint bounded redir... | 2026-09-11 |
| CVE-2026-86074 | high | 7.1 | No | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the Instance AI credential setup flow accepted a credential... | 2026-09-11 |
| CVE-2026-15439 | medium | 6.5 | No | The GamiPress plugin for WordPress is vulnerable to authenticated (Subscriber+) SQL Injection via the 'q' parameter of the wpForo integratio... | 2026-09-11 |
| CVE-2026-19646 | critical | 9.1 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirec... | 2026-09-11 |
| CVE-2026-86073 | high | 7.6 | No | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first... | 2026-09-11 |
| CVE-2026-89264 | medium | 4.3 | No | MoguBlog through 6.2 fails to validate the comment author identity in the POST /web/comment/add endpoint, allowing authenticated users to po... | 2026-09-11 |
| CVE-2026-7863 | high | 8.4 | No | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo... | 2026-09-11 |
| CVE-2026-8303 | high | 7.8 | No | Incorrect privilege assignment vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus-software allows Privilege Esc... | 2026-09-11 |
| CVE-2026-8301 | high | 7.8 | No | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software Technolo... | 2026-09-11 |
| CVE-2026-87988 | not reported | — | No | An arbitrary file access vulnerability in Mistral Vibe allows an attacker to bypass workspace restrictions through commands classified as un... | 2026-09-11 |
| CVE-2026-87987 | not reported | — | No | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using environment variable... | 2026-09-11 |
| CVE-2026-87986 | not reported | — | No | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using shell constructs it's... | 2026-09-11 |
| CVE-2026-87985 | not reported | — | No | An arbitrary code execution vulnerability in Mistral Vibe allows an attacker to bypass command permission checks using ANSI-C quoted argumen... | 2026-09-11 |