Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-7192 | not reported | — | No | A stack-based buffer overflow vulnerability in the Dbit T-CPE301K 4G WiFi minirouter allows an authenticated attacker to cause a denial of s... | 2026-09-29 |
| CVE-2026-102334 | high | 7.4 | No | Nginx Proxy Manager through 2.16.0 lacks rate-limiting on authentication endpoints, allowing unauthenticated attackers to make unlimited pas... | 2026-09-29 |
| CVE-2026-102005 | medium | 5.5 | No | Wind River VxWorks 7 24.03 through 26.03, a memory leak occurs under specific, non-default configuration states when processing specific ser... | 2026-09-29 |
| CVE-2026-102807 | medium | 5.3 | No | OpenClaw before 2026.9.4 contains an incorrect authorization vulnerability in the mcp.app.view method that allows read-scoped operators to e... | 2026-09-29 |
| CVE-2026-102806 | medium | 6.3 | No | OpenClaw before 2026.9.5 contains an incorrect authorization vulnerability in the Gateway's local media root allowlist that breaks filesyste... | 2026-09-29 |
| CVE-2026-96431 | not reported | — | No | Unrestricted Upload of File with Dangerous Type in the /WebAgenda/download/uploadFile.jsp API endpoint of Flowring Agentflow 4.0 version bef... | 2026-09-29 |
| CVE-2026-96430 | not reported | — | No | Exposed Dangerous Method or Function in the /WebAgenda/SQLWin.do API endpoint of Flowring Agentflow 4.0 version Before 2026/08/28 allows rem... | 2026-09-29 |
| CVE-2026-96429 | not reported | — | No | SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attac... | 2026-09-29 |
| CVE-2026-96428 | not reported | — | No | SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attack... | 2026-09-29 |
| CVE-2026-100603 | medium | 5.4 | No | ClawHub (openclaw/clawhub) application/backend contains a flaw in the skill report moderation flow: four distinct ordinary authenticated acc... | 2026-09-29 |
| CVE-2026-100602 | medium | 6.5 | No | ClawHub (openclaw/clawhub application/backend) contains a missing authorization check in the changelog preview feature. A signed-in caller c... | 2026-09-29 |
| CVE-2026-102697 | high | 7.8 | No | Ollama versions 0.14.0 before 0.31.2 contain an incorrect authorization vulnerability in the experimental agent mode Bash tool approval mech... | 2026-09-29 |
| CVE-2026-102633 | medium | 5.9 | No | libexpat versions 2.7.2 through 2.8.5 contain an integer overflow vulnerability in expat_realloc() function on 32-bit platforms when computi... | 2026-09-29 |
| CVE-2026-91154 | not reported | — | No | Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProduc... | 2026-09-29 |
| CVE-2026-88805 | high | 8.1 | No | Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out.... | 2026-09-29 |
| CVE-2026-88804 | critical | 9.6 | No | An unauthenticated update of public UI settings could be used by remote attackers to execute a stored cross-site scripting attack in the Ran... | 2026-09-29 |
| CVE-2026-78424 | high | 8.8 | No | Improper parameter handling in NeuVector allows any authenticated user who holds the namespaced Runtime Policies (write) permission or anyon... | 2026-09-29 |
| CVE-2026-94287 | medium | 5.5 | No | A denial of service via unsigned underflow in libXpm's write path in libXpm before 3.5.19 could be used by local attackers to cause unbounde... | 2026-09-29 |
| CVE-2026-95835 | not reported | — | No | Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running t... | 2026-09-29 |
| CVE-2026-95834 | not reported | — | No | Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the term... | 2026-09-29 |