Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86720 | high | 8.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.jso... | 2026-09-08 |
| CVE-2026-86718 | high | 7.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.jso... | 2026-09-08 |
| CVE-2026-18073 | medium | 4.4 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralizatio... | 2026-09-08 |
| CVE-2026-18078 | medium | 6.5 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow. | 2026-09-08 |
| CVE-2026-67397 | not reported | — | No | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. | 2026-09-08 |
| CVE-2021-44320 | high | 7.5 | No | Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the de... | 2026-09-08 |
| CVE-2026-75430 | critical | 9.8 | No | PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the... | 2026-09-08 |
| CVE-2026-31020 | critical | 9.8 | No | In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot... | 2026-09-08 |
| CVE-2026-78970 | medium | 6.5 | No | JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker w... | 2026-09-08 |
| CVE-2026-75431 | critical | 9.1 | No | PowerJob Server version 5.1.2 (and likely earlier) uses a predictable JWT signing key for HS256-based authentication. This allows a remote a... | 2026-09-08 |
| CVE-2026-75168 | medium | 6.3 | No | An issue in the ugw-editfile method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenticated... | 2026-09-08 |
| CVE-2026-75164 | medium | 6.5 | No | An arbitrary file read vulnerability in /cgi-bin/ugwdownload.cgi of MBS-Solutions X-Serie Gateway firmware V6_00_05 allows a remote authenti... | 2026-09-08 |
| CVE-2026-75163 | medium | 6.5 | No | An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V6_00_... | 2026-09-08 |
| CVE-2026-75160 | critical | 9.1 | No | An issue in X-Serie Gateway Firmware V6_00_05 allows a remote attacker to escalate privileges via the endpoints /cgi-bin/wwwugw.cgi and /cgi... | 2026-09-08 |
| CVE-2026-85509 | critical | 9.8 | No | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _read_fru_data in libfreeipmi/fru/ipmi-fru.c when a BMC returns more bytes than... | 2026-09-08 |
| CVE-2026-85508 | critical | 9.8 | No | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _output_dell_system_info_cmc_ipv6_info in ipmi-oem/ipmi-oem-dell.c (... | 2026-09-08 |
| CVE-2026-85504 | critical | 9.8 | No | FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string... | 2026-09-08 |
| CVE-2026-52111 | critical | 9.8 | No | An issue in fast-note-sync-service <=2.13.7 allows a remote attacker to escalate privileges via the admin configuration endpoint exposes aut... | 2026-09-08 |
| CVE-2026-51974 | high | 8.8 | No | An eval() injection vulnerability in the get_list function in modules/meta_parser.py in lllyasviel Fooocus 2.1.854 through 2.5.5 allows remo... | 2026-09-08 |
| CVE-2026-18221 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to gain unauthorized access due to improper validation of client-supplied authent... | 2026-09-08 |