Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100867 | low | 3.3 | No | spaceship-prompt through 4.22.5 fails to sanitize control characters from project manifest version fields before rendering them in the zsh p... | 2026-09-30 |
| CVE-2026-100863 | medium | 5.0 | No | Heym versions 0.0.90 and earlier contain two server-side request forgery (SSRF) egress gaps, both remediated in app/services/ssrf_guard.py i... | 2026-09-30 |
| CVE-2026-100862 | medium | 4.9 | No | heym, a workflow automation platform, stores and returns multiple capability secrets in plaintext in versions prior to 0.0.91. Affected secr... | 2026-09-30 |
| CVE-2026-100859 | medium | 6.5 | No | Heym before 0.0.106 contains a credential exfiltration vulnerability in the POST /api/credentials/test endpoint that allows collaborators wi... | 2026-09-30 |
| CVE-2026-100858 | medium | 6.8 | No | heym before 0.0.109 contains a server-side request forgery vulnerability in the Slack, Discord, and Crawler workflow nodes. These nodes issu... | 2026-09-30 |
| CVE-2026-100851 | high | 7.6 | No | AzuraCast before 0.23.8 contains a broken access control vulnerability in the GET /api/station/{id}/vue/profile endpoint that allows authent... | 2026-09-30 |
| CVE-2026-100850 | high | 7.7 | No | AzuraCast before 0.23.8 contains a server-side request forgery and local file read vulnerability in the AutoDJ remote playlist fetch (backen... | 2026-09-30 |
| CVE-2026-100847 | high | 7.5 | No | AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers... | 2026-09-30 |
| CVE-2026-100843 | high | 7.8 | No | MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle() function due to unsafe pickle.loads() de... | 2026-09-30 |
| CVE-2026-100835 | high | 7.4 | No | Contrast before 1.16.0 is susceptible to remote attestation relay attacks. Contrast accepted any TEE attestation report that verified correc... | 2026-09-30 |
| CVE-2026-100744 | high | 7.3 | No | A flaw has been found in coollabsio Coolify up to 4.1.2. The affected element is an unknown function of the file app/Http/Middleware/CanUpda... | 2026-09-30 |
| CVE-2026-100698 | medium | 5.8 | No | Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. Th... | 2026-09-30 |
| CVE-2026-100694 | medium | 6.1 | No | Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered wit... | 2026-09-30 |
| CVE-2026-100690 | high | 7.5 | No | Hugo versions from v0.161.0 through v0.165.0 run Node.js tools (css.PostCSS, css.TailwindCSS, js.Babel) under the Node.js permission model t... | 2026-09-30 |
| CVE-2026-100678 | medium | 6.5 | No | stoatchat before 0.15.5 fails to enforce account-level attempt limits on MFA login challenges, allowing attackers who know a password to gue... | 2026-09-30 |
| CVE-2026-100308 | high | 7.8 | No | Deserialization of untrusted data in the model loading component in Amazon GluonTS before 0.17.0 might allow context-dependent attackers to... | 2026-09-30 |
| CVE-2026-73192 | medium | 6.1 | No | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getVali... | 2026-09-30 |
| CVE-2026-102510 | not reported | — | No | Integer Overflow, Improper Validation of Array Index, Uncontrolled Recursion and Memory Allocation with Excessive Size Value in the Go imple... | 2026-09-30 |
| CVE-2026-102509 | not reported | — | No | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits, and Uncontrolled Recursion in the Java implementation o... | 2026-09-30 |
| CVE-2026-102508 | not reported | — | No | Improper Verification of Cryptographic Signature and Improper Certificate Validation in the OPC UA driver of Apache PLC4X (PLC4J) allows an... | 2026-09-30 |