Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85540 | high | 8.8 | No | DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to rea... | 2026-09-08 |
| CVE-2026-84043 | medium | 5.3 | No | The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation r... | 2026-09-08 |
| CVE-2026-82923 | critical | 9.8 | No | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allow... | 2026-09-08 |
| CVE-2026-85149 | medium | 5.3 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85148 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can explo... | 2026-09-08 |
| CVE-2026-85147 | high | 7.5 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85146 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-78234 | critical | 9.9 | No | A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace... | 2026-09-08 |
| CVE-2026-77968 | high | 8.2 | No | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh... | 2026-09-08 |
| CVE-2026-76925 | medium | 5.8 | No | A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` com... | 2026-09-08 |
| CVE-2026-85769 | medium | 6.5 | No | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual... | 2026-09-08 |
| CVE-2026-85534 | medium | 5.9 | No | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data t... | 2026-09-08 |
| CVE-2026-84185 | medium | 5.9 | No | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issu... | 2026-09-08 |
| CVE-2026-75021 | high | 8.1 | No | fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the... | 2026-09-08 |
| CVE-2026-82325 | not reported | — | No | A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a sy... | 2026-09-08 |
| CVE-2026-84732 | not reported | — | No | Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via... | 2026-09-08 |
| CVE-2026-84226 | not reported | — | No | OpenVPN version 2.5.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to perform a binary planting a... | 2026-09-08 |
| CVE-2026-82312 | not reported | — | No | OpenVPN 2.0.0 through 2.6.22 and 2.7_alpha1 through 2.7.6 on Windows allows local authenticated users to cause a denial of service via a NUL... | 2026-09-08 |
| CVE-2026-81830 | not reported | — | No | The Windows interactive service in OpenVPN 2.4.0 through 2.6.22 allows local authenticated users to bypass the trusted configuration directo... | 2026-09-08 |
| CVE-2026-81738 | not reported | — | No | OpenVPN 2.5.0 through 2.7.6 on Windows using the tap-windows6 driver allows attackers to trigger an out-of-bounds write via crafted DOMAIN-S... | 2026-09-08 |