Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79759 | medium | 4.3 | No | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the PO... | 2026-09-29 |
| CVE-2026-86065 | high | 7.5 | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /subscribe endpoint in network/a... | 2026-09-29 |
| CVE-2026-77602 | critical | 9.9 | No | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.1.0 until 7.3... | 2026-09-29 |
| CVE-2026-57176 | medium | 6.8 | No | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used only the numeric... | 2026-09-29 |
| CVE-2026-56737 | high | 8.1 | No | phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authe... | 2026-09-29 |
| CVE-2026-96759 | critical | 9.8 | No | orval before 8.29.0 fails to escape the operationId parameter when emitting it into generated TanStack Query mutator options metadata object... | 2026-09-29 |
| CVE-2026-96754 | critical | 9.8 | No | orval versions before 8.29.0 contain a code injection vulnerability in the @orval/hono generator that fails to escape OpenAPI path values in... | 2026-09-29 |
| CVE-2026-96672 | medium | 6.4 | No | Frappe ERPNext versions before 16.34.1 fail to validate that Financial Report Template calculation_formula values reference whitelisted meth... | 2026-09-29 |
| CVE-2026-95844 | high | 7.5 | No | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, Moquette does not limit the depth of topic names and topic filters before proce... | 2026-09-29 |
| CVE-2026-92164 | medium | 6.5 | No | Streamlink is a CLI utility which pipes video streams from various services into a video player. Prior to 8.6.0, HTTPSession mounts a FileAd... | 2026-09-29 |
| CVE-2026-58147 | not reported | — | No | WNC T-Mobile 5G Box IDU router contains an OS command injection vulnerability in the portal.cgi component's password change functionality. T... | 2026-09-28 |
| CVE-2026-58146 | not reported | — | No | WNC T-Mobile 5G Box IDU router is vulnerable to OS command injection vulnerability. The vulnerability exists within the /cgi-bin/portal.cgi... | 2026-09-28 |
| CVE-2026-40857 | not reported | — | No | WNC T-Mobile 5G Box IDU router contains a cross-site request forgery (CSRF) vulnerability in the portal.cgi component. The anti-CSRF mechani... | 2026-09-28 |
| CVE-2026-40856 | not reported | — | No | WNC T-Mobile 5G Box IDU router is vulnerable to improper access control. The vulnerability exists in the wnc_maccheck.cgi endpoint, which is... | 2026-09-28 |
| CVE-2026-40855 | not reported | — | No | WNC T-Mobile 5G Box IDU router is vulnerable to a command injection. The vulnerability exists in the ping functionality within the /cgi-bin/... | 2026-09-28 |
| CVE-2026-40854 | not reported | — | No | WNC T-Mobile 5G Box IDU router contains an authentication bypass vulnerability in the portal.cgi component. The session verification mechani... | 2026-09-28 |
| CVE-2026-92357 | medium | 4.3 | No | A vulnerability was identified in a2ui-project a2ui 0.8/0.9/1.0. Impacted is an unknown function of the file model-processor.ts of the compo... | 2026-09-28 |
| CVE-2026-92356 | medium | 4.3 | No | A vulnerability was determined in a2ui-project a2ui 0.9/0.9.1. This issue affects the function updateComponents of the file basic_functions.... | 2026-09-28 |
| CVE-2026-76562 | high | 7.2 | No | The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbm_description' parameter in all versi... | 2026-09-28 |
| CVE-2026-86518 | medium | 6.3 | No | A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The mani... | 2026-09-28 |