Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100619 | high | 8.8 | No | Capgo (capgo.app) blocks direct user inserts into the public.manifest table with a RESTRICTIVE row-level security policy, but that restricti... | 2026-09-30 |
| CVE-2026-100618 | high | 8.5 | No | Capgo (capgo.app) is affected by an authorization flaw in the app icon update path. The PUT /app/:id endpoint accepts a user-controlled `ico... | 2026-09-30 |
| CVE-2026-100617 | high | 8.8 | No | Cap-go capgo.app fails to validate that principals in channel_permission_overrides belong to the organization, allowing authenticated app/or... | 2026-09-30 |
| CVE-2026-100613 | medium | 5.3 | No | capgo.app is an over-the-air (OTA) update platform for Capacitor apps. In all versions up to and including the current release (no patch ava... | 2026-09-30 |
| CVE-2026-100611 | medium | 6.5 | No | Capgo (capgo.app backend, versions ≤ 12.261.0) improperly restricts which roles the apikey_manager organization role may bind to newly creat... | 2026-09-30 |
| CVE-2026-100387 | high | 8.1 | No | pgPointcloud through 1.2.5 contains a heap out-of-bounds read vulnerability in dimensional patch WKB deserialization that allows authenticat... | 2026-09-30 |
| CVE-2026-100306 | medium | 5.3 | No | TDuck survey form through 6.0 fails to validate write passwords on submission endpoints, enforcing the check only on the front end. Remote u... | 2026-09-30 |
| CVE-2023-53899 | critical | 9.8 | No | PodcastGenerator 3.2.9 contains a blind server-side request forgery vulnerability that allows attackers to inject XML in the episode upload... | 2026-09-30 |
| CVE-2026-69271 | high | 8.0 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 2026-09-30 |
| CVE-2026-69269 | high | 7.8 | No | Integer underflow (wrap or wraparound) in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68897 | high | 7.0 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68892 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68891 | medium | 4.7 | No | Out-of-bounds read in Microsoft Standard XPS allows an authorized attacker to disclose information locally. | 2026-09-30 |
| CVE-2026-68890 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges locally. | 2026-09-30 |
| CVE-2026-68889 | high | 7.1 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 2026-09-30 |
| CVE-2026-81352 | high | 8.8 | No | Heap-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to execute code over a network. | 2026-09-30 |
| CVE-2026-54524 | not reported | — | No | Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inj... | 2026-09-30 |
| CVE-2026-54504 | high | 8.8 | No | MCP Documentation Server is a local-first document management and semantic search server for AI coding agents. From 1.13.0 until 1.13.1, the... | 2026-09-30 |
| CVE-2026-52851 | high | 7.1 | No | Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a per... | 2026-09-30 |
| CVE-2026-52727 | high | 7.2 | No | lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built f... | 2026-09-30 |