Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97149 | not reported | — | No | In OpenStack Swift before 2.38.2, the tempurl middleware does not reject the X-Copy-From header on PUT requests. A TempURL signature only co... | 2026-10-06 |
| CVE-2026-94293 | critical | 9.8 | No | An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by t... | 2026-10-06 |
| CVE-2026-88393 | critical | 9.8 | No | WookTeam v1.6.6 and before is vulnerable to RCE in the project task export interface /api/project/task/export. The data parameter is base64-... | 2026-10-06 |
| CVE-2026-92931 | high | 8.8 | No | CWE-918: Server-Side Request Forgery in the Progress @progress/sitefinity-nextjs-sdk npm package versions 15.1.8326 through 15.4.8637 may al... | 2026-10-06 |
| CVE-2026-88416 | critical | 9.8 | No | MCMS 6.1.1 through 6.2.1 has a SQL injection vulnerability in the custom model/form import feature. | 2026-10-06 |
| CVE-2026-88385 | medium | 6.5 | No | Mini-XML 4.0.5 contains a memory leak vulnerability in mxml_load_data() during malformed XML parsing. Specially crafted XML input can cause... | 2026-10-06 |
| CVE-2026-88383 | medium | 6.2 | No | libical 4.0.6 contains an incompatible function pointer in icalparameter_string_to_kind(). When parsing iCalendar data containing a paramete... | 2026-10-06 |
| CVE-2026-88371 | medium | 5.5 | No | ZBar commit 2ea2ca58 contains an undefined-behavior vulnerability in the Code 128 decode6() function. When processing specially crafted Code... | 2026-10-06 |
| CVE-2026-88366 | high | 7.5 | No | NanoSVG commit 239e102ec contains an incorrect numeric conversion vulnerability in nsvg__pathArcTo() when parsing SVG arc commands. A specia... | 2026-10-06 |
| CVE-2026-88355 | high | 7.5 | No | An incorrect buffer size calculation vulnerability exists in tinyexpr commit 4a7456e in new_expr(). For arity-0 expression nodes, including... | 2026-10-06 |
| CVE-2026-88360 | high | 7.5 | No | libvips 8.19.0 contains a memory access vulnerability when processing little-endian PFM images. If the PFM text header length is not a multi... | 2026-10-06 |
| CVE-2026-78862 | medium | 6.8 | No | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the UART serial interface on the printed circuit board (P... | 2026-10-06 |
| CVE-2026-77804 | medium | 6.6 | No | In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, a time-of-check time-of-use (TOCTOU) race condition... | 2026-10-06 |
| CVE-2026-77803 | low | 3.6 | No | In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, front-end request desynchronization is possible in t... | 2026-10-06 |
| CVE-2026-77802 | medium | 6.3 | No | In Progress® Telerik® Fiddler® Classic for Windows, versions prior to v6.0.20262.10021, HTTP request smuggling is possible in the proxy requ... | 2026-10-06 |
| CVE-2026-79311 | medium | 6.1 | No | webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__(). | 2026-10-06 |
| CVE-2026-77178 | critical | 9.1 | No | Oracle VM VirtualBox before 7.2.8 allows guest OS users to cause an out-of-bounds write in the host OS in pcnetReceiveNoSync in DevPCNet.cpp... | 2026-10-06 |
| CVE-2026-52001 | high | 7.5 | No | An issue in geelen mcp-remote 0.1.18 through 0.1.38 allows a remote attacker to obtain sensitive information via the SSE transport eventSour... | 2026-10-06 |
| CVE-2026-19954 | medium | 5.4 | No | Net::Whois::Raw versions before 2.99044 for Perl ship a pwhois command-line tool that queries WHOIS for the wrong domain for unicode domain... | 2026-10-06 |
| CVE-2026-106041 | medium | 6.5 | No | Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject co... | 2026-10-06 |