Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19727 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulti... | 2026-09-08 |
| CVE-2026-19205 | high | 7.5 | No | Observable response discrepancy vulnerability in GastroMenum GastroMenum Web Panel allows Account Footprinting. This issue affects GastroMe... | 2026-09-08 |
| CVE-2026-77818 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Yordam Information Technology Consulti... | 2026-09-08 |
| CVE-2026-19081 | medium | 4.3 | No | Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constra... | 2026-09-08 |
| CVE-2026-19057 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Gastromenum Gastromenum Ticket and QR... | 2026-09-08 |
| CVE-2026-18198 | high | 8.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TAC Information Services Internal and... | 2026-09-08 |
| CVE-2026-19080 | high | 7.5 | No | Observable response discrepancy vulnerability in Menulux Software Inc. Menulux Portal allows Account Footprinting. This issue affects Menul... | 2026-09-08 |
| CVE-2026-19051 | high | 7.1 | No | Plaintext storage of a password vulnerability in Menulux Software Inc. Menulux Portal allows Retrieve Embedded Sensitive Data. This issue a... | 2026-09-08 |
| CVE-2026-19043 | medium | 4.3 | No | Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs.... | 2026-09-08 |
| CVE-2026-18957 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal a... | 2026-09-08 |
| CVE-2026-6217 | medium | 6.3 | No | Use of a One-Way hash without a salt vulnerability in Pik Online Software Solutions Inc. Pik Online Portal allows Cryptanalysis. This issue... | 2026-09-08 |
| CVE-2026-85242 | not reported | — | No | PlaywrightCapture contains a server-side request forgery (SSRF) vulnerability in its favicon retrieval functionality. When only_global_looku... | 2026-09-08 |
| CVE-2026-85649 | high | 7.9 | No | (Holloway) Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root u... | 2026-09-08 |
| CVE-2026-85547 | not reported | — | No | A cross-site request forgery (CSRF) vulnerability exists in MISP due to form-security and CSRF protections being disabled based on whether a... | 2026-09-08 |
| CVE-2026-85538 | not reported | — | No | An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required p... | 2026-09-08 |
| CVE-2026-85533 | not reported | — | No | An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to u... | 2026-09-08 |
| CVE-2026-15937 | not reported | — | No | Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS cer... | 2026-09-08 |
| CVE-2026-15933 | not reported | — | No | OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously conf... | 2026-09-08 |
| CVE-2026-77654 | not reported | — | No | Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privil... | 2026-09-08 |
| CVE-2026-14466 | medium | 4.3 | No | It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with approp... | 2026-09-08 |