Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-68487 | critical | 9.9 | No | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. | 2026-09-10 |
| CVE-2026-65639 | not reported | — | No | OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allo... | 2026-09-10 |
| CVE-2026-65638 | not reported | — | No | Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary comman... | 2026-09-10 |
| CVE-2026-87913 | medium | 5.9 | No | A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain... | 2026-09-10 |
| CVE-2026-87912 | medium | 5.9 | No | A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remo... | 2026-09-10 |
| CVE-2026-84969 | low | 3.7 | No | A memory-handling error in the BSON-to-JSON conversion helpers of the MongoDB C Driver can write a small number of bytes past the end of a h... | 2026-09-10 |
| CVE-2026-84970 | medium | 5.8 | No | A numeric truncation weakness exists in the JSON parsing component of the MongoDB C++ Driver's BSON library. An actor who controls the text... | 2026-09-10 |
| CVE-2026-87106 | medium | 6.5 | No | Consul and Consul Enterprise are vulnerable to a denial of service in the native RPC listener that may allow an authenticated client to exha... | 2026-09-10 |
| CVE-2026-87090 | high | 8.3 | No | Consul and Consul Enterprise are vulnerable to an authorization bypass in the catalog node-write path that may allow an authenticated attack... | 2026-09-10 |
| CVE-2026-89049 | critical | 9.9 | No | A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts... | 2026-09-10 |
| CVE-2026-85216 | critical | 9.8 | No | MISP contains an authentication bypass vulnerability in its LDAP and LinOTP authentication components due to insufficient validation of user... | 2026-09-10 |
| CVE-2026-85221 | critical | 9.1 | No | MISP contains an improper TLS certificate validation vulnerability in CurlClient. The CurlClient::$verifyPeer property was not explicitly in... | 2026-09-10 |
| CVE-2026-85226 | medium | 4.3 | No | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute val... | 2026-09-10 |
| CVE-2026-85227 | medium | 6.1 | No | MISP contains a reflected Cross-Site Scripting (XSS) vulnerability in the event attribute filtering query builder. The taggedAttributes and... | 2026-09-10 |
| CVE-2026-85230 | medium | 5.4 | No | A persistent unsafe URL injection vulnerability exists in the MISP dashboard ButtonWidget configuration. Dashboard widget URLs were validate... | 2026-09-10 |
| CVE-2026-87436 | medium | 6.5 | No | Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web... | 2026-09-10 |
| CVE-2026-87515 | medium | 6.5 | No | Incorrect authorization in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass... | 2026-09-10 |
| CVE-2026-87503 | medium | 6.5 | No | Inappropriate implementation in Downloads in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social... | 2026-09-10 |
| CVE-2026-87499 | high | 8.1 | No | Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer proces... | 2026-09-10 |
| CVE-2026-87505 | high | 8.1 | No | Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pro... | 2026-09-10 |