Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19915 | not reported | — | No | A potential security vulnerability has been identified in the HP Support Assistant for versions prior to 9.55.10.0. The vulnerability could... | 2026-09-29 |
| CVE-2026-44940 | medium | 5.7 | No | The rancher-extension-stackstate extension in SUSE Observability exposes service tokens in plain configuration or insecure locations rather... | 2026-09-29 |
| CVE-2026-101139 | low | 2.7 | No | A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/m... | 2026-09-29 |
| CVE-2026-100574 | medium | 5.9 | No | OpenClaw (npm package 'openclaw') before 2026.8.1 contains a server-side request forgery vulnerability in its trusted-host DNS checks. For f... | 2026-09-29 |
| CVE-2026-100570 | high | 7.8 | No | OpenClaw (npm package 'openclaw') versions >= 2026.3.28 and < 2026.8.1 allow an untrusted workspace .env file to set the CLOUDSDK_PYTHON_ARG... | 2026-09-29 |
| CVE-2026-100561 | high | 8.0 | No | OpenClaw (npm package 'openclaw') versions >= 2026.3.22 and < 2026.8.1 contain an approval-bypass flaw in the exec approval policy: the poli... | 2026-09-29 |
| CVE-2026-100557 | high | 8.3 | No | OpenClaw versions before 2026.8.1 contain an authorization bypass vulnerability in skill tool dispatch that fails to carry the sender's owne... | 2026-09-29 |
| CVE-2026-100553 | medium | 4.3 | No | OpenClaw versions >= 2026.6.9 and < 2026.8.1 do not declare the native chatId parameter as a delivery target in the Feishu unpin feature, so... | 2026-09-29 |
| CVE-2026-100549 | medium | 5.4 | No | OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in QQBot voice attachment handling where filenames are decoded twic... | 2026-09-29 |
| CVE-2026-100545 | medium | 5.3 | No | OpenClaw (npm package `openclaw`) before 2026.8.1 incorrectly enforces sender tool policies during session-memory filename generation. In af... | 2026-09-29 |
| CVE-2026-88022 | high | 7.7 | No | Improper neutralization of special elements in data query logic in the MongoDB integration for Laravel can cause an array supplied to an exp... | 2026-09-29 |
| CVE-2026-63498 | medium | 5.4 | No | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, the uploaded-files API endpoint GET /api/v1/{object_type}/{id}/files/{fil... | 2026-09-29 |
| CVE-2026-62368 | high | 8.4 | No | Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a user with the customfields.create permission can store markup in Custom... | 2026-09-29 |
| CVE-2026-88023 | high | 8.3 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB PHP Library can cause a caller-suppli... | 2026-09-29 |
| CVE-2026-88024 | high | 8.3 | No | Improper neutralization of special elements in data query logic in the GridFS component of the MongoDB Rust Driver can cause a caller-suppli... | 2026-09-29 |
| CVE-2026-56198 | high | 7.8 | No | Out-of-bounds read in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally. | 2026-09-29 |
| CVE-2026-62762 | medium | 6.5 | No | Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network. | 2026-09-29 |
| CVE-2026-65812 | medium | 6.8 | No | Insertion of sensitive information into sent data in Microsoft Teams for Android allows an authorized attacker to disclose information over... | 2026-09-29 |
| CVE-2026-68828 | high | 8.8 | No | Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-09-29 |
| CVE-2026-68850 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Account allows an authorized attacker to elevate privileges locally. | 2026-09-29 |