Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101885 | high | 7.8 | No | ZeroClaw versions before 0.8.5 built with plugins-wasm feature contain a path traversal vulnerability in plugin installation that fails to v... | 2026-10-01 |
| CVE-2026-101884 | high | 7.5 | No | OpenClaw Windows Node before 2026.7.1 contains an incomplete environment-variable sanitizer in system.run that fails to block GIT_CONFIG_*,... | 2026-10-01 |
| CVE-2026-101881 | medium | 6.5 | No | OpenClaw Windows Node before 2026.7.1 contains an allocation of resources without limits vulnerability in the gateway WebSocket transport th... | 2026-10-01 |
| CVE-2026-101880 | high | 8.8 | No | OpenClaw Windows Node before 2026.7.1 contains an incorrect authorization vulnerability in the system.run exec-approval policy where ExecShe... | 2026-10-01 |
| CVE-2026-103387 | medium | 4.3 | No | A weakness has been identified in garycourt uri-js up to 4.4.1. This affects the function URI.parse of the file src/schemes/mailto.ts of the... | 2026-10-01 |
| CVE-2026-100888 | high | 7.3 | No | A weakness has been identified in Trusted Domain Project OpenDKIM up to 2.11.0. This affects the function dkim_canon_selecthdrs of the file... | 2026-09-30 |
| CVE-2026-101088 | medium | 5.3 | No | Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesent... | 2026-09-30 |
| CVE-2026-101084 | critical | 9.6 | No | obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, allowing any authenticated user to connect t... | 2026-09-30 |
| CVE-2026-101062 | high | 8.8 | No | Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICATION=true exposes OAuth dynamic client registra... | 2026-09-30 |
| CVE-2026-101058 | medium | 6.9 | No | python-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agen... | 2026-09-30 |
| CVE-2026-100885 | high | 7.3 | No | A vulnerability was found in Krayin laravel-crm up to 2.2.4. This affects an unknown function of the file packages/Webkul/Installer/src/Http... | 2026-09-30 |
| CVE-2026-100882 | low | 2.4 | No | A vulnerability was detected in Krayin laravel-crm up to 2.2.5. Impacted is an unknown function of the file packages/Webkul/Admin/src/Resour... | 2026-09-30 |
| CVE-2026-100879 | medium | 4.3 | No | A security flaw has been discovered in zhistaredu StarTraining up to 3.8.1. This affects the function checkRoleAllowed of the file SysRoleSe... | 2026-09-30 |
| CVE-2026-100876 | medium | 6.3 | No | A vulnerability was found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown... | 2026-09-30 |
| CVE-2026-100873 | medium | 4.3 | No | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element... | 2026-09-30 |
| CVE-2025-68398 | critical | 9.1 | No | Weblate is a web based localization tool. In versions prior to 5.15.1, it was possible to overwrite Git configuration remotely and override... | 2026-09-30 |
| CVE-2025-34449 | critical | 9.1 | No | Genymobile/scrcpy versions up to and including 3.3.3, prior to commit 3e40b24, contain a buffer overflow vulnerability in the sc_device_msg_... | 2026-09-30 |
| CVE-2025-14849 | critical | 9.8 | No | Advantech WebAccess/SCADA is vulnerable to unrestricted file upload, which may allow an attacker to remotely execute arbitrary code. | 2026-09-30 |
| CVE-2025-68145 | critical | 9.1 | No | In mcp-server-git versions prior to 2025.12.17, when the server is started with the --repository flag to restrict operations to a specific r... | 2026-09-30 |
| CVE-2025-10798 | critical | 9.8 | No | A vulnerability was identified in code-projects Hostel Management System 1.0. Impacted is an unknown function of the file /justines/admin/mo... | 2026-09-30 |