Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100848 | high | 7.1 | No | AzuraCast (Composer package azuracast/azuracast) before 0.23.8 validates a station's "Remote Relay" URL only for URL syntax and an http/http... | 2026-09-28 |
| CVE-2026-101089 | low | 3.1 | No | Nezha before 2.2.7 contains an information disclosure vulnerability in the GET /api/v1/profile endpoint that returns the bcrypt-hashed passw... | 2026-09-28 |
| CVE-2026-101085 | medium | 6.5 | No | Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed... | 2026-09-28 |
| CVE-2026-101050 | medium | 6.5 | No | Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credential_id is absent or... | 2026-09-28 |
| CVE-2026-100872 | high | 7.5 | No | Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculation, allowing unauthenticated attackers to mo... | 2026-09-28 |
| CVE-2026-100869 | medium | 5.9 | No | Sylius versions before 2.1.16 and 2.2.9 fail to restrict payment request actions in the Shop API endpoint, allowing customers to trigger ref... | 2026-09-28 |
| CVE-2026-100865 | high | 8.8 | No | Heym before 0.0.53 evaluates workflow condition expressions using Python's eval() with insufficient sandboxing in the workflow executor serv... | 2026-09-28 |
| CVE-2026-100864 | high | 8.8 | No | heym before 0.0.91 contains a sandbox escape vulnerability in the expression engine's DotList map/filter and fallback resolver that allows a... | 2026-09-28 |
| CVE-2026-100861 | medium | 5.0 | No | heym before 0.0.105 fails to apply egress guards to integration services that use credential-supplied base URLs, allowing authenticated user... | 2026-09-28 |
| CVE-2026-100860 | medium | 5.5 | No | heym before 0.0.105 does not act on the result of the credential authorization lookup in the Redis workflow node (backend/app/services/node_... | 2026-09-28 |
| CVE-2026-100628 | medium | 4.3 | No | capgo.app before 12.128.12 fails to enforce an organization's API key expiration policy when creating app-scoped API keys. In the POST /apik... | 2026-09-28 |
| CVE-2026-100622 | high | 7.5 | No | capgo.app through 12.129.0 fails to verify deletion status when serving cached bundle artifacts from the public file read endpoint. Unauthen... | 2026-09-28 |
| CVE-2026-100615 | high | 8.8 | No | Cap-go capgo.app before 12.267.1 fails to validate target API key privilege during rotation, allowing an apikey_manager to rotate a higher-p... | 2026-09-28 |
| CVE-2026-100614 | high | 8.8 | No | Capgo before 12.244.1 contains a cross-tenant integrity vulnerability in the metadata-cleaning worker that trusts image object keys from mut... | 2026-09-28 |
| CVE-2026-97063 | critical | 9.1 | No | X-SpringBoot through 6.0 returns login verification codes in HTTP responses from unauthenticated endpoints GET /sys/mobile/code and GET /sys... | 2026-09-28 |
| CVE-2026-87969 | not reported | — | No | An OS command injection vulnerability in the WatchGuard AP diagnostic CLI allows an authenticated administrator to execute arbitrary operati... | 2026-09-28 |
| CVE-2026-86102 | not reported | — | No | An OS command injection vulnerability in the WatchGuard AP internal API service allows an attacker with network access to the AP to execute... | 2026-09-28 |
| CVE-2026-101891 | not reported | — | No | An improper access control vulnerability in an internal API service on WatchGuard Access Points allows an unauthenticated attacker with netw... | 2026-09-28 |
| CVE-2026-100626 | medium | 4.3 | No | capgo through 12.128.2 contains an insecure direct object reference vulnerability in the PUT /app/:appId endpoint that accepts attacker-cont... | 2026-09-28 |
| CVE-2026-100305 | medium | 4.3 | No | TDuck survey form through 6.0 fails to enforce form fill-in restrictions on the authenticated submission endpoint POST /user/form/data/creat... | 2026-09-28 |