Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84204 | medium | 6.5 | No | GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. A... | 2026-09-08 |
| CVE-2026-84203 | high | 8.1 | No | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain accoun... | 2026-09-08 |
| CVE-2026-84202 | high | 8.8 | No | ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object cons... | 2026-09-08 |
| CVE-2026-84201 | high | 7.1 | No | appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers... | 2026-09-08 |
| CVE-2026-84194 | not reported | — | No | LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery... | 2026-09-08 |
| CVE-2026-84193 | not reported | — | No | LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced... | 2026-09-08 |
| CVE-2026-84191 | medium | 6.1 | No | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and... | 2026-09-08 |
| CVE-2026-84187 | high | 8.2 | No | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary... | 2026-09-08 |
| CVE-2026-83595 | high | 8.1 | No | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing action... | 2026-09-08 |
| CVE-2026-86716 | high | 7.3 | No | A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Execu... | 2026-09-08 |
| CVE-2026-80119 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an inform... | 2026-09-08 |
| CVE-2026-80117 | high | 7.1 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privile... | 2026-09-08 |
| CVE-2026-80116 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privile... | 2026-09-08 |
| CVE-2026-80114 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-co... | 2026-09-08 |
| CVE-2026-80112 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improp... | 2026-09-08 |
| CVE-2026-74236 | medium | 6.5 | No | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_emai... | 2026-09-08 |
| CVE-2026-74235 | medium | 4.9 | No | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. T... | 2026-09-08 |
| CVE-2026-85452 | high | 8.8 | No | MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names... | 2026-09-08 |
| CVE-2026-85426 | critical | 9.8 | No | MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can injec... | 2026-09-08 |
| CVE-2022-51008 | medium | 5.3 | No | PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without... | 2026-09-08 |