Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86216 | medium | 4.3 | No | A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of th... | 2026-09-08 |
| CVE-2026-86211 | high | 7.3 | No | A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the compone... | 2026-09-08 |
| CVE-2026-86182 | medium | 4.3 | No | A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/... | 2026-09-08 |
| CVE-2026-86171 | medium | 6.3 | No | A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.... | 2026-09-08 |
| CVE-2026-86165 | critical | 9.8 | No | A vulnerability was found in Tenda HG10 300001138. This vulnerability affects the function formURL of the file /boaform/admin/formURL. Perfo... | 2026-09-08 |
| CVE-2026-86160 | high | 7.3 | No | A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php... | 2026-09-08 |
| CVE-2026-86150 | medium | 4.1 | No | A security vulnerability has been detected in Tenda CP3 27.5.57.101. Impacted is an unknown function of the file custom-x/softap/hostapd. Su... | 2026-09-08 |
| CVE-2026-79697 | critical | 9.9 | No | A vulnerability was determined in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610... | 2026-09-08 |
| CVE-2026-77263 | high | 7.2 | No | The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-09-08 |
| CVE-2026-4945 | medium | 5.3 | No | The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Re... | 2026-09-08 |
| CVE-2026-14350 | medium | 5.3 | No | IBM Cloud Pak for Data System 11.3.0.2 through Interim Fix 001 could allow an unauthorized user to inject data into log messages due to impr... | 2026-09-08 |
| CVE-2026-5522 | medium | 6.7 | No | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 005 contains hard-coded credentials, such as a password or cryptographic key, which it uses... | 2026-09-08 |
| CVE-2026-19274 | critical | 9.6 | No | IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated Kubernetes tena... | 2026-09-08 |
| CVE-2026-81859 | medium | 6.2 | No | CP4BA - IBM Enterprise Records could allow a local attacker to obtain sensitive information due to the use of a broken or risky cryptographi... | 2026-09-08 |
| CVE-2026-19795 | medium | 6.2 | No | Qiskit could allow a local attacker to cause a denial of service due to a stack overflow during deserialization of QPY payloads. A malicious... | 2026-09-08 |
| CVE-2026-79707 | not reported | — | No | A Path Traversal vulnerability in the builder endpoint in Google Cloud Agent Development Kit (ADK) versions 1.9.0 through 1.21.0 on Python a... | 2026-09-08 |
| CVE-2026-4644 | not reported | — | No | A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud... | 2026-09-08 |
| CVE-2026-82729 | not reported | — | No | Inefficient Algorithmic Complexity vulnerability in elixir-mint mint allows a remote HTTP server to exhaust CPU on the client host and cause... | 2026-09-08 |
| CVE-2026-82728 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a remote HTTP server to exhaust memory on the... | 2026-09-08 |
| CVE-2026-86590 | not reported | — | No | In Eclipse Che versions 7.79.0 through 7.121.0, the dashboard backend's POST /dashboard/api/data/resolver endpoint passes a caller-supplied... | 2026-09-08 |