Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88915 | not reported | — | No | Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates usi... | 2026-09-10 |
| CVE-2026-88790 | medium | 4.8 | No | A security vulnerability has been detected in proma-ai Proma up to 0.19.37. Affected is the function resolveTargetPath of the file apps/elec... | 2026-09-10 |
| CVE-2026-88277 | high | 8.8 | No | GeoVision GV-LPC2211 V1.13 allows an authenticated ONVIF user to inject shell commands through ConsumerReference.Address and execute arbitra... | 2026-09-10 |
| CVE-2026-88272 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled username containing shell metacharacters to be executed as arbitrary root comm... | 2026-09-10 |
| CVE-2026-88271 | high | 8.8 | No | GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. | 2026-09-10 |
| CVE-2026-88270 | medium | 6.5 | No | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is va... | 2026-09-10 |
| CVE-2026-87925 | high | 7.3 | No | A vulnerability was detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This vulnerability affe... | 2026-09-10 |
| CVE-2026-87924 | medium | 6.5 | No | A security vulnerability has been detected in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. This affe... | 2026-09-10 |
| CVE-2026-86810 | high | 7.3 | No | A vulnerability was detected in Open-Web-Analytics up to 1.9.1. The impacted element is the function checkCapabilityAndAuthenticateUser of t... | 2026-09-10 |
| CVE-2026-86675 | medium | 6.3 | No | A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us_edit.php.... | 2026-09-10 |
| CVE-2026-86213 | high | 7.3 | No | A vulnerability was found in Mstfakts College-Management-System. This issue affects the function mysqli_query of the file Front-end/universi... | 2026-09-10 |
| CVE-2026-86208 | high | 7.3 | No | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /d... | 2026-09-10 |
| CVE-2026-84819 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WPAdverts <= 2.3.3 versions. | 2026-09-10 |
| CVE-2026-85630 | medium | 6.1 | No | HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method. Any... | 2026-09-10 |
| CVE-2026-85485 | medium | 6.1 | No | HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping. The Table form layout and the Bo... | 2026-09-10 |
| CVE-2026-85484 | medium | 6.1 | No | HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping. The Sele... | 2026-09-10 |
| CVE-2026-84282 | medium | 6.5 | No | A Server-Side Request Forgery (SSRF) vulnerability exists in the ONLYOFFICE ownCloud Integration plugin version 9.12. The /apps/onlyoffice/a... | 2026-09-10 |
| CVE-2026-81801 | high | 8.1 | No | Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. | 2026-09-10 |
| CVE-2026-81794 | high | 7.5 | No | Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. | 2026-09-10 |
| CVE-2026-81787 | medium | 6.5 | No | Unauthenticated Broken Authentication in IMPress for IDX Broker <= 3.3.0 versions. | 2026-09-10 |