Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-48542 | medium | 5.4 | No | Krayin CRM through 2.2.6 contains a stored client-side template injection vulnerability that allows authenticated attackers to execute arbit... | 2026-09-29 |
| CVE-2026-56792 | medium | 4.4 | No | Dell Rugged Control Center (RCC), versions prior to 5.2.206, contain an Improper Authorization vulnerability. A low privileged attacker with... | 2026-09-29 |
| CVE-2026-52850 | medium | 4.3 | No | Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace member who does not belong... | 2026-09-29 |
| CVE-2026-97359 | critical | 10.0 | No | HFS2 version 2.4.0 and earlier contains a template injection vulnerability in the multipart upload handler that allows unauthenticated attac... | 2026-09-29 |
| CVE-2026-97231 | high | 7.3 | No | A vulnerability was found in volotat Anagnorisis up to 0.3.1/0.4.0. Affected is an unknown function of the file app.py of the component Sock... | 2026-09-29 |
| CVE-2026-97061 | medium | 4.3 | No | Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enume... | 2026-09-29 |
| CVE-2026-96882 | medium | 5.3 | No | A vulnerability was identified in TaleLin lin-cms-spring-boot up to 0.2.1. Affected by this vulnerability is the function searchBook of the... | 2026-09-29 |
| CVE-2026-96777 | medium | 6.3 | No | A vulnerability was determined in Forma LMS up to 4.1.43. This impacts the function UserselectorAdmController::getDataTask of the file /appC... | 2026-09-29 |
| CVE-2026-96763 | medium | 5.4 | No | A security flaw has been discovered in kvcache-ai mooncake up to 0.3.12/0.3.13.post1/0.3.14-rc1. This issue affects the function ScopedSegme... | 2026-09-29 |
| CVE-2026-96678 | medium | 6.3 | No | A security vulnerability has been detected in weiqingwen spring-boot-forum up to 538eecc3c6b85fdf0768ab4e8354b48c0c17d94f. Affected is the f... | 2026-09-29 |
| CVE-2026-96602 | high | 7.3 | No | A flaw has been found in Abdurrab5 online-makeup-store. This impacts an unknown function of the file customerSignin.php of the component Cus... | 2026-09-29 |
| CVE-2026-88387 | medium | 5.5 | No | LibRaw 0.22.0 contains an incorrect numeric conversion vulnerability in LibRaw::parse_tiff_ifd() when processing TIFF tag 0x00fe (NewSubfile... | 2026-09-29 |
| CVE-2026-94613 | high | 7.5 | No | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an unauthenticated attacker can submit a malformed... | 2026-09-29 |
| CVE-2026-91134 | medium | 5.4 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the Discourse post sanitizer allowed a... | 2026-09-29 |
| CVE-2026-91132 | medium | 4.3 | No | Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the a... | 2026-09-29 |
| CVE-2026-88378 | critical | 9.8 | No | QuickJS commit 04be24600 contains a heap out-of-bounds write condition in JS_ReadFunctionTag(). | 2026-09-29 |
| CVE-2026-96550 | low | 3.7 | No | A vulnerability was found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This issue affects the function getProperti... | 2026-09-29 |
| CVE-2026-88377 | medium | 6.2 | No | Bento4 1.6.0.0 contains an integer underflow vulnerability in the avcC and hvcC configuration atom parsers. A specially crafted MP4 file con... | 2026-09-29 |
| CVE-2026-88365 | critical | 9.8 | No | minimp3 commit ea99364f contains an integer overflow vulnerability in mp3dec_skip_id3v1() when parsing the APEv2 tag-size field. | 2026-09-29 |
| CVE-2026-88358 | medium | 6.5 | No | simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON doc... | 2026-09-29 |