Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-52770 | high | 7.5 | No | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated... | 2026-09-08 |
| CVE-2026-52769 | high | 8.3 | No | YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/{formId}/actor/inbox route - expose... | 2026-09-08 |
| CVE-2026-52767 | high | 8.2 | No | YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, HttpSignatureService::verifySignature() checks the resu... | 2026-09-08 |
| CVE-2026-52763 | medium | 6.5 | No | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the recentchanges action (actions/recentchanges.php) accepts a period argum... | 2026-09-08 |
| CVE-2026-52762 | not reported | — | No | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki Bazar contains a stored Server-Side Template Injection (SSTI) vulne... | 2026-09-08 |
| CVE-2026-63464 | high | 7.7 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role... | 2026-09-08 |
| CVE-2026-61699 | high | 8.1 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that... | 2026-09-08 |
| CVE-2026-55513 | medium | 5.4 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI hos... | 2026-09-08 |
| CVE-2026-53604 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the... | 2026-09-08 |
| CVE-2026-53603 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintex... | 2026-09-08 |
| CVE-2026-53602 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that... | 2026-09-08 |
| CVE-2026-73848 | not reported | — | No | Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the... | 2026-09-08 |
| CVE-2026-53757 | not reported | — | No | Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchiv... | 2026-09-08 |
| CVE-2026-53756 | medium | 4.9 | No | Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUse... | 2026-09-08 |
| CVE-2026-78522 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-09-08 |
| CVE-2026-80079 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-09-08 |
| CVE-2026-83949 | medium | 5.5 | No | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 2026-09-08 |
| CVE-2026-83951 | medium | 5.5 | No | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 2026-09-08 |
| CVE-2026-85614 | high | 8.6 | No | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that ac... | 2026-09-08 |
| CVE-2026-85613 | high | 8.2 | No | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that al... | 2026-09-08 |