Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85092 | medium | 6.6 | No | LiME through 1.12.0 fails to validate the disk acquisition output path and does not use O_NOFOLLOW when opening the operator-supplied path p... | 2026-09-10 |
| CVE-2026-84715 | high | 8.8 | No | FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated su... | 2026-09-10 |
| CVE-2026-84697 | medium | 5.3 | No | Mailpit's IsInternalIP deny list function fails to block the Azure WireServer address 168.63.129.16 and the RFC 2765/6145 IPv4-translated IP... | 2026-09-10 |
| CVE-2026-84694 | high | 8.8 | No | Coolify before 4.2.0 fails to properly escape environment variable key names in Docker commands executed over SSH on managed servers. Authen... | 2026-09-10 |
| CVE-2026-73789 | medium | 5.3 | No | A vulnerability in the web-based management interface of CPPM guest account management services could allow an unauthenticated remote attack... | 2026-09-10 |
| CVE-2026-73788 | medium | 6.5 | No | A vulnerability in the ClearPass OnGuard agent could allow an authenticated remote attacker to elevate their own privileges on a vulnerable... | 2026-09-10 |
| CVE-2026-73786 | high | 7.5 | No | A vulnerability in the web-based management interface of CPPM could allow an unauthenticated remote attacker to conduct a Denial-of-Service... | 2026-09-10 |
| CVE-2026-85180 | high | 7.5 | No | Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloa... | 2026-09-10 |
| CVE-2026-84696 | high | 8.2 | No | Phison PS3111-S11 controller firmware versions through SBFQT1.3 expose privileged vendor unique commands over the ATA interface with absent... | 2026-09-10 |
| CVE-2026-79908 | high | 7.8 | No | Acrobat Reader is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the curre... | 2026-09-10 |
| CVE-2026-84821 | high | 7.5 | No | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions. | 2026-09-10 |
| CVE-2026-81803 | high | 7.5 | No | Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions. | 2026-09-10 |
| CVE-2026-81795 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Page Visits Counter – Lite <= 1.2.3 versions. | 2026-09-10 |
| CVE-2026-81788 | medium | 6.3 | No | Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. | 2026-09-10 |
| CVE-2026-81783 | high | 7.1 | No | Subscriber Broken Authentication in MailMunch – Grow your Email List <= 3.2.5 versions. | 2026-09-10 |
| CVE-2026-66632 | medium | 6.5 | No | Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions. | 2026-09-10 |
| CVE-2026-59679 | critical | 9.0 | No | fs_read_glyphs() in the libXfont2 font-server client (src/fc/fserve.c) indexes the per-character encoding[] array using num_chars from the F... | 2026-09-10 |
| CVE-2026-42808 | medium | 6.8 | No | An issue was discovered in Bosch Sensortec COINES_SDK versions 2.0 through 2.11. The host streaming API function {{coines_read_stream_sens... | 2026-09-10 |
| CVE-2026-88069 | not reported | — | No | Pandora contains a path traversal vulnerability in its archive extraction worker. When processing a specially crafted archive or disk image,... | 2026-09-10 |
| CVE-2026-86097 | medium | 6.5 | No | PX4 Autopilot through 1.17.0 contains a null pointer dereference vulnerability in param_set_default_file() and param_set_backup_file() funct... | 2026-09-10 |