Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75137 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault d... | 2026-09-08 |
| CVE-2026-75136 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometr... | 2026-09-08 |
| CVE-2026-75135 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master passwo... | 2026-09-08 |
| CVE-2026-84695 | high | 8.7 | No | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64... | 2026-09-08 |
| CVE-2026-84483 | medium | 5.3 | No | WWBN AVideo through commit 9c39d8c8 contains an incomplete authentication bypass in encryptPass.json.php that allows unauthenticated attacke... | 2026-09-08 |
| CVE-2026-84482 | high | 8.8 | No | WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDomain() functions tha... | 2026-09-08 |
| CVE-2026-84481 | not reported | — | No | WWBN AVideo through 30.0 contains an information disclosure vulnerability in the MobileManager plugin getConfiguration endpoint that returns... | 2026-09-08 |
| CVE-2026-84480 | critical | 9.8 | No | WWBN AVideo fails to validate password recovery token expiration in userRecoverPassSave.json.php, allowing attackers to use expired tokens t... | 2026-09-08 |
| CVE-2026-84479 | critical | 9.1 | No | WWBN AVideo (current e01e41ecc and earlier) makes three login-time security controls depend solely on the client-supplied User-Agent header.... | 2026-09-08 |
| CVE-2026-84478 | high | 7.3 | No | WWBN AVideo contains a path traversal vulnerability in the API get_api_login_code endpoint that allows unauthenticated attackers to delete a... | 2026-09-08 |
| CVE-2026-84477 | medium | 5.4 | No | AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inj... | 2026-09-08 |
| CVE-2026-84476 | high | 7.5 | No | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client... | 2026-09-08 |
| CVE-2026-84208 | high | 7.5 | No | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and citie... | 2026-09-08 |
| CVE-2023-54391 | critical | 9.8 | No | Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that... | 2026-09-08 |
| CVE-2026-73524 | medium | 6.1 | No | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary s... | 2026-09-08 |
| CVE-2026-71981 | high | 8.8 | No | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system... | 2026-09-08 |
| CVE-2026-45221 | high | 7.8 | No | Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by pla... | 2026-09-08 |
| CVE-2026-8712 | high | 8.3 | No | Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to forc... | 2026-09-08 |
| CVE-2026-84207 | medium | 5.4 | No | Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect... | 2026-09-08 |
| CVE-2026-84205 | medium | 6.5 | No | GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter bu... | 2026-09-08 |