Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-44402 | critical | 9.8 | No | Voltronic Power SNMP Web Pro 1.1 contains an unauthenticated remote code execution vulnerability in the upload.cgi firmware update endpoint... | 2026-09-10 |
| CVE-2026-85695 | critical | 9.4 | No | FastChat contains an authentication bypass vulnerability in the /register_worker endpoint that allows unauthenticated attackers to register... | 2026-09-10 |
| CVE-2026-85694 | high | 8.1 | No | LaVague 0.2.35 contains a remote code execution vulnerability in PythonFromMarkdownExtractor.extract_as_object that evaluates untrusted lang... | 2026-09-10 |
| CVE-2026-85692 | medium | 6.5 | No | Nightingale (n9e), as of commit 8362cbe (main branch, confirmed 2026-08-27), contains a server-side request forgery vulnerability in the isP... | 2026-09-10 |
| CVE-2026-85687 | high | 7.5 | No | surya 0.22.1 screenshot server contains an unauthenticated arbitrary file read vulnerability in the /info, /page, and /process routes that a... | 2026-09-10 |
| CVE-2026-85667 | critical | 9.1 | No | xiaobei through 5.5.2 fails to implement authentication or signature validation on webhook endpoints, allowing unauthenticated attackers to... | 2026-09-10 |
| CVE-2026-85663 | critical | 9.8 | No | Aim 3.29.1 remote tracking server fails to authenticate requests and dispatches arbitrary methods through getattr without allowlist validati... | 2026-09-10 |
| CVE-2026-85624 | medium | 6.5 | No | Blinko 1.8.7 contains a cross-user private note disclosure vulnerability in the noteReferenceList procedure that performs no ownership verif... | 2026-09-10 |
| CVE-2026-85622 | medium | 5.3 | No | AppFlowy-Cloud through 0.9.64 fails to validate workspace membership when establishing WebSocket connections in the establish_ws_connection_... | 2026-09-10 |
| CVE-2026-85619 | high | 7.5 | No | AppFlowy-Cloud 0.9.64 fails to verify that requested collab objects belong to the workspace in authorization checks, allowing attackers to a... | 2026-09-10 |
| CVE-2026-85608 | high | 7.5 | No | Douyin_TikTok_Download_API through 4.1.2 contains a server-side request forgery vulnerability in the /api/download and /api/hybrid/video_dat... | 2026-09-10 |
| CVE-2026-85607 | high | 8.8 | No | Blinko 1.8.7 contains an authorization bypass (IDOR) vulnerability in multiple tRPC procedures (message.list, message.update, message.delete... | 2026-09-10 |
| CVE-2026-85390 | high | 7.1 | No | Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing... | 2026-09-10 |
| CVE-2026-85214 | high | 8.1 | No | vhr fails to validate user authorization in the PUT /hr/info endpoint, allowing authenticated users to modify arbitrary HR profiles by suppl... | 2026-09-10 |
| CVE-2026-85213 | high | 7.6 | No | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesC... | 2026-09-10 |
| CVE-2026-85212 | high | 8.3 | No | CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both condi... | 2026-09-10 |
| CVE-2026-85211 | high | 7.7 | No | Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can... | 2026-09-10 |
| CVE-2026-85183 | critical | 9.3 | No | Taipy configures its socket.io server with wildcard CORS origin and credential flag enabled, allowing any web page to establish credentialed... | 2026-09-10 |
| CVE-2026-85182 | high | 7.5 | No | vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated a... | 2026-09-10 |
| CVE-2026-85093 | medium | 6.5 | No | Cheshire Cat AI's GET /memory/collections/{collection_id}/points endpoint fails to apply per-user filtering when retrieving episodic memory... | 2026-09-10 |