Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86597 | medium | 6.5 | No | Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authenticati... | 2026-09-10 |
| CVE-2026-86541 | high | 8.3 | No | knowns versions before 0.30.0 contain a path traversal vulnerability in the handleCodeReplace() function that allows attackers to overwrite... | 2026-09-10 |
| CVE-2026-86438 | high | 7.2 | No | Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administr... | 2026-09-10 |
| CVE-2026-86258 | medium | 5.9 | No | nbviewer through 1.0.1 contains a path traversal vulnerability in LocalFileHandler.can_show() that uses string-prefix comparison instead of... | 2026-09-10 |
| CVE-2026-86253 | medium | 5.9 | No | h3 (npm package) versions <= 2.0.1-rc.14 contain a path traversal vulnerability in serveStatic(). On Node.js deployments, event.url.pathname... | 2026-09-10 |
| CVE-2026-86192 | medium | 6.5 | No | SiYuan versions before v3.8.2 fail to properly filter private attribute-view cell values in the getAttributeViewKeys endpoint. Publish reade... | 2026-09-10 |
| CVE-2026-86187 | medium | 5.9 | No | WWBN AVideo generates passwords for external-login accounts using rand() instead of a cryptographic generator, producing only 31-bit integer... | 2026-09-10 |
| CVE-2026-86117 | high | 8.1 | No | Coolify through 4.3.17 contains an authentication bypass vulnerability in the OAuth callback handler that signs users into existing accounts... | 2026-09-10 |
| CVE-2026-86112 | medium | 5.4 | No | BookWyrm through 0.9.1 fails to validate user visibility permissions in the Favorite and Unfavorite views, allowing authenticated attackers... | 2026-09-10 |
| CVE-2026-86096 | medium | 5.9 | No | PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in TemperatureCalibration::start() due to a race condition between task... | 2026-09-10 |
| CVE-2026-85696 | critical | 9.8 | No | SadTalker contains an OS command injection vulnerability in the video muxing process where uploaded audio filenames are interpolated into ff... | 2026-09-10 |
| CVE-2026-85674 | high | 7.8 | No | aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted... | 2026-09-10 |
| CVE-2026-85669 | medium | 6.5 | No | potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated a... | 2026-09-10 |
| CVE-2026-85664 | high | 7.5 | No | Chroma 1.5.9 fails to validate maximum bounds on HNSW index parameters max_neighbors, ef_construction, and ef_search in collection-create re... | 2026-09-10 |
| CVE-2026-85623 | high | 8.8 | No | goose 1.37.0 executes arbitrary commands from recipe stdio extensions and retry.checks without security inspection. Attackers can distribute... | 2026-09-10 |
| CVE-2026-85618 | medium | 6.5 | No | ConvertX 0.17.0 contains an arbitrary file read vulnerability in the xelatex converter that allows authenticated users to read files by uplo... | 2026-09-10 |
| CVE-2026-85615 | medium | 6.4 | No | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC proce... | 2026-09-10 |
| CVE-2026-85610 | high | 8.8 | No | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to exec... | 2026-09-10 |
| CVE-2026-85601 | medium | 5.4 | No | Grav Admin before 2.0.20 fails to sanitize output from marked.parse() before injecting it into the DOM via Svelte's {@html} directive in Mar... | 2026-09-10 |
| CVE-2026-85591 | not reported | — | No | phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user control panel API endpoint that allows authenticat... | 2026-09-10 |