Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86196 | not reported | — | No | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing u... | 2026-09-08 |
| CVE-2026-86195 | not reported | — | No | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags()... | 2026-09-08 |
| CVE-2026-86193 | not reported | — | No | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user manager... | 2026-09-08 |
| CVE-2026-86191 | medium | 4.3 | No | SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish r... | 2026-09-08 |
| CVE-2026-86190 | critical | 9.1 | No | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password... | 2026-09-08 |
| CVE-2026-86188 | high | 7.2 | No | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary J... | 2026-09-08 |
| CVE-2026-86186 | medium | 6.5 | No | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operatio... | 2026-09-08 |
| CVE-2026-86113 | medium | 6.5 | No | BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to mo... | 2026-09-08 |
| CVE-2026-86111 | medium | 6.5 | No | BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read f... | 2026-09-08 |
| CVE-2026-86100 | medium | 6.4 | No | Camaleon CMS versions 2.7.5 through 2.9.1 fail to validate redirect targets when fetching remote files in the Upload from URL media feature.... | 2026-09-08 |
| CVE-2026-85604 | high | 8.8 | No | Grav before 2.0.18 (affected versions <= 2.0.17) contains a remote code execution vulnerability in the Twig sort filter. The sortFunc wrappe... | 2026-09-08 |
| CVE-2026-85602 | medium | 5.3 | No | The Grav Form plugin (getgrav/grav-plugin-form) versions 8.0.6 through 9.1.19 select the reCAPTCHA version to validate based solely on which... | 2026-09-08 |
| CVE-2026-85600 | medium | 5.4 | No | Grav Admin (getgrav/grav-plugin-admin2) versions <= 2.0.19 contain a stored cross-site scripting vulnerability in the tHtml() function (src/... | 2026-09-08 |
| CVE-2026-85599 | high | 7.2 | No | Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary par... | 2026-09-08 |
| CVE-2026-85592 | low | 3.7 | No | phpMyFAQ before 4.1.8 contains an authorization bypass vulnerability in the question creation endpoint where the isAddingQuestionsAllowed()... | 2026-09-08 |
| CVE-2026-85590 | not reported | — | No | phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The rem... | 2026-09-08 |
| CVE-2026-85589 | not reported | — | No | phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-healt... | 2026-09-08 |
| CVE-2026-85587 | not reported | — | No | phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inac... | 2026-09-08 |
| CVE-2026-85585 | high | 7.5 | No | SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entri... | 2026-09-08 |
| CVE-2026-85584 | high | 7.5 | No | SiYuan versions before v3.8.2 contain a denial of service vulnerability in the publish-service Basic Auth throttle that stores failed-attemp... | 2026-09-08 |