Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93365 | medium | 6.5 | No | Bludit CMS through 3.22.0 contains a missing authorization vulnerability that allows authenticated users holding the Author or Editor role t... | 2026-09-28 |
| CVE-2026-93364 | medium | 4.3 | No | Bludit CMS through 3.22.0 contains a mass assignment vulnerability that allows authenticated users with the Author role to modify privileged... | 2026-09-28 |
| CVE-2026-6544 | medium | 6.2 | No | IBM Concert 1.0.0 through 3.0.0 allows recursive copying of directories without proper controls which can lead to unintentional inclusion of... | 2026-09-28 |
| CVE-2026-6925 | medium | 5.3 | No | IBM Concert 1.0.0 through 3.0.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially craf... | 2026-09-28 |
| CVE-2026-6794 | high | 7.8 | No | IBM Concert 1.0.0 through 3.0.0 has a double free vulnerability that exists due to incorrect memory management. A local attacker can exploit... | 2026-09-28 |
| CVE-2026-6730 | high | 7.8 | No | IBM Concert 1.0.0 through 3.0.0 is vulnerable to a buffer overflow, caused by improper bounds checking. A local user could overflow the buff... | 2026-09-28 |
| CVE-2026-6721 | critical | 9.8 | No | IBM Concert 1.0.0 through 3.0.0 allows an unauthenticated remote attacker can supply specially crafted input that is incorporated into OS co... | 2026-09-28 |
| CVE-2026-70582 | medium | 6.4 | No | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Instrumentation allows an... | 2026-09-28 |
| CVE-2026-70583 | high | 7.8 | No | Heap-based buffer overflow in Windows Core Messaging allows an authorized attacker to elevate privileges locally. | 2026-09-28 |
| CVE-2026-77492 | medium | 5.5 | No | Out-of-bounds read in Storage Port Driver allows an authorized attacker to disclose information locally. | 2026-09-28 |
| CVE-2026-85740 | high | 7.1 | No | LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, _validated_addresses in lightrag/parser/markdown/parser.py... | 2026-09-28 |
| CVE-2026-83602 | medium | 6.5 | No | Netdata is an open source observability tool. From 2.0.0 until 2.11.0, Netdata registers /api/v3/settings in src/web/api/v3/web_api_v3.c wit... | 2026-09-28 |
| CVE-2026-76804 | medium | 5.5 | No | Nuclei is a vulnerability scanner built on a simple YAML-based DSL. From 3.0.0 until 3.10.0, the workflow template loading path does not enf... | 2026-09-28 |
| CVE-2026-75608 | high | 7.7 | No | Frigate is an open source network video recorder. Prior to 0.18.0, the prefix-matched location /api/go2rtc/api in docker/main/rootfs/usr/loc... | 2026-09-28 |
| CVE-2026-56681 | high | 7.3 | No | 9Router is an AI router & token saver. Prior to 0.5.6, 9Router deployments that allow requests to reach Next.js without the sanitizing custo... | 2026-09-28 |
| CVE-2026-100313 | medium | 4.3 | No | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an un... | 2026-09-28 |
| CVE-2026-100598 | high | 7.1 | No | OpenClaw (npm package openclaw) before 2026.7.1 incorrectly binds Signal approval reactions. In affected versions, a reaction intended to re... | 2026-09-28 |
| CVE-2026-100594 | medium | 6.5 | No | OpenClaw versions before 2026.7.1 contain an authorization bypass vulnerability in the /export-trajectory endpoint that allows non-owner sen... | 2026-09-28 |
| CVE-2026-100590 | medium | 4.3 | No | OpenClaw before 2026.7.1 contains an authorization bypass vulnerability in the /voice set command that allows non-owner external-channel sen... | 2026-09-28 |
| CVE-2026-100586 | high | 8.8 | No | OpenClaw Codex before 2026.7.1 fails to properly enforce owner authorization when creating native conversation bindings. Non-owner channel s... | 2026-09-28 |