Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85611 | medium | 6.4 | No | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayo... | 2026-09-08 |
| CVE-2026-85609 | high | 7.5 | No | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker... | 2026-09-08 |
| CVE-2026-85388 | high | 8.1 | No | Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated user... | 2026-09-08 |
| CVE-2026-82526 | critical | 9.8 | No | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements b... | 2026-09-08 |
| CVE-2026-82024 | medium | 5.4 | No | LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the I... | 2026-09-08 |
| CVE-2026-82023 | medium | 4.3 | No | LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with... | 2026-09-08 |
| CVE-2026-71963 | high | 8.8 | No | Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute... | 2026-09-08 |
| CVE-2026-85175 | high | 8.8 | No | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),... | 2026-09-08 |
| CVE-2026-85174 | high | 8.8 | No | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timi... | 2026-09-08 |
| CVE-2026-85164 | high | 7.1 | No | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails... | 2026-09-08 |
| CVE-2026-85163 | medium | 6.5 | No | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders t... | 2026-09-08 |
| CVE-2026-85162 | medium | 6.5 | No | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost a... | 2026-09-08 |
| CVE-2026-85161 | medium | 4.3 | No | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbid... | 2026-09-08 |
| CVE-2026-85160 | high | 8.1 | No | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers... | 2026-09-08 |
| CVE-2026-85159 | medium | 5.4 | No | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is ec... | 2026-09-08 |
| CVE-2026-85158 | medium | 5.4 | No | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter i... | 2026-09-08 |
| CVE-2026-85157 | medium | 5.3 | No | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility... | 2026-09-08 |
| CVE-2026-85156 | medium | 5.3 | No | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and gr... | 2026-09-08 |
| CVE-2026-85155 | high | 7.5 | No | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allo... | 2026-09-08 |
| CVE-2026-85154 | critical | 9.8 | No | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer toke... | 2026-09-08 |