Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86362 | high | 8.2 | No | Dell System Update, versions prior to 2.3.0.0, contains an Improper Access Control vulnerability. A low privileged attacker with local acces... | 2026-10-14 |
| CVE-2022-2586 | high | 7.8 | Listed | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that... | 2026-10-14 |
| CVE-2026-70352 | critical | 10.0 | No | Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network. | 2026-10-14 |
| CVE-2026-52296 | high | 7.1 | No | FFmpeg before 9.0 has an out-of-bounds read because of missing required padding in WMA extradata allocation paths in libavcodec/wmaenc.c. | 2026-10-14 |
| CVE-2026-96661 | high | 7.5 | No | The Gmedia Photo Gallery plugin for WordPress is vulnerable to time-based SQL Injection via the 'gmedia__in' parameter in all versions up to... | 2026-10-14 |
| CVE-2026-94348 | medium | 6.1 | No | Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Improper Neutralization of Special Elements used in an SQL Command ('SQ... | 2026-10-14 |
| CVE-2026-94377 | high | 7.2 | No | The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all... | 2026-10-14 |
| CVE-2026-93388 | critical | 9.8 | No | The Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce is vulnerable to unauthenticated arbitrary file upload leading to remo... | 2026-10-14 |
| CVE-2026-92817 | high | 8.8 | No | The Ignition Perspective module does not properly validate session privileges when determining Designer-level access. An authenticated user... | 2026-10-14 |
| CVE-2026-91156 | high | 7.5 | No | Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could... | 2026-10-14 |
| CVE-2026-52297 | high | 7.1 | No | FFmpeg before 9.0 has an out-of-bounds read because there is insufficiently padded extradata in the MOV parsing path in mov_read_iacb in lib... | 2026-10-14 |
| CVE-2026-17092 | high | 8.1 | No | The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all... | 2026-10-14 |
| CVE-2026-110627 | medium | 4.7 | No | ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to in... | 2026-10-14 |
| CVE-2026-110622 | high | 7.5 | No | Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' page... | 2026-10-14 |
| CVE-2026-110261 | medium | 5.5 | No | OW2 ASM 3.0 before 9.11 contains a denial of service vulnerability that allows attackers to exhaust CPU by supplying crafted class files pro... | 2026-10-14 |
| CVE-2026-109228 | high | 7.5 | No | SGLang through 0.5.21 contains a resource budget bypass vulnerability that allows remote attackers to override GLM-V video processing limits... | 2026-10-14 |
| CVE-2026-109205 | high | 7.5 | No | LogicalDOC Community Edition through 9.3 contains an unauthenticated file upload vulnerability in the UploadServlet that allows remote attac... | 2026-10-14 |
| CVE-2026-108898 | low | 3.5 | No | A vulnerability was detected in Netis WF2409E 3.3.42541. This affects an unknown function of the component Wireless Settings. The manipulati... | 2026-10-14 |
| CVE-2026-109187 | medium | 6.5 | No | jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration s... | 2026-10-14 |
| CVE-2026-109182 | medium | 4.3 | No | jshERP through 3.6 contains an incorrect authorization vulnerability in GET /supplier/exportExcel that allows authenticated users to bypass... | 2026-10-14 |