Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-80181 | critical | 9.1 | No | Apache Allura's webhooks are vulnerable to Server-Side Request Forgery (SSRF). This issue affects Apache Allura: through 1.20.0. Users are... | 2026-09-08 |
| CVE-2026-52691 | high | 8.8 | No | ** UNSUPPORTED WHEN ASSIGNED ** Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache... | 2026-09-08 |
| CVE-2026-47625 | high | 7.5 | No | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit... | 2026-09-08 |
| CVE-2026-16497 | high | 7.5 | No | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause excessive iteration. A successful exploit of... | 2026-09-08 |
| CVE-2026-16769 | not reported | — | No | An unencrypted 'pause encryption request' message causes a denial of service in the in the RS9116W/SiWx917. See vulnerability B-E10 in the r... | 2026-09-08 |
| CVE-2026-16028 | high | 7.5 | No | Protocol::HTTP2 versions before 1.14 for Perl allow memory exhaustion via closed streams that stream_state never removes from the connection... | 2026-09-08 |
| CVE-2026-86206 | not reported | — | No | A vulnerability in the N-central internal API access control filter allows unauthorised access to internal APIs. This is fixed in N-central... | 2026-09-08 |
| CVE-2026-86207 | not reported | — | No | An authentication bypass in N-central < 2026.3 HF 3 leads to authentication bypass in internal only APIs | 2026-09-08 |
| CVE-2026-86135 | not reported | — | No | A Cross-Site Request Forgery (CSRF) vulnerability in WatchGuard Dimension's database snapshot creation feature allows a remote attacker to t... | 2026-09-08 |
| CVE-2026-85400 | not reported | — | No | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and conf... | 2026-09-08 |
| CVE-2026-77132 | not reported | — | No | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowe... | 2026-09-08 |
| CVE-2026-84186 | not reported | — | No | Vulnerability involving incorrect access control in the Tools::getRemoteAddr() function in PrestaShop, which allows the client’s IP address... | 2026-09-08 |
| CVE-2026-85038 | medium | 5.3 | No | The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does n... | 2026-09-08 |
| CVE-2026-84937 | medium | 6.8 | No | The Video Player for YouTube WordPress plugin before 2.1.0 does not properly sanitise and escape user-supplied input before using it in a SQ... | 2026-09-08 |
| CVE-2026-84936 | medium | 5.3 | No | The EmbedPress WordPress plugin before 4.6.4 does not have proper authorization on a public review-loading action, allowing unauthenticated... | 2026-09-08 |
| CVE-2026-84935 | high | 8.0 | No | The HT Menu WordPress plugin before 1.2.7 does not perform any capability or object-ownership check when saving navigation menu-item setting... | 2026-09-08 |
| CVE-2026-84934 | high | 8.0 | No | The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the req... | 2026-09-08 |
| CVE-2026-84931 | medium | 6.8 | No | The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside... | 2026-09-08 |
| CVE-2026-84930 | medium | 6.8 | No | The CatFolders Document Gallery & PDF Library WordPress plugin before 2.0.7 does not properly validate a block attribute before using it as... | 2026-09-08 |
| CVE-2026-84045 | medium | 5.3 | No | The E-cab Taxi Booking Manager for Woocommerce WordPress plugin before 2.0.5 does not validate a client-supplied trip distance and base-pric... | 2026-09-08 |