Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93990 | high | 7.5 | No | Expat before 2.8.5 fails to validate that a high surrogate in UTF-16 input is followed by a low surrogate, allowing malformed UTF-16 sequenc... | 2026-09-28 |
| CVE-2026-90926 | high | 8.8 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. C... | 2026-09-28 |
| CVE-2026-90925 | high | 7.1 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Innotim Software, Telecommunications and Con... | 2026-09-28 |
| CVE-2026-90924 | critical | 9.8 | No | Use of default credentials vulnerability in Innotim Software, Telecommunications and Consultancy Trade Ltd. Co. Logsign SIEM allows Try Comm... | 2026-09-28 |
| CVE-2026-87798 | medium | 5.8 | No | Improper link resolution in the recursive file pull feature of the LXD CLI client in Canonical LXD versions 4.0.2 up to 6.9 (fixed in 4.0.14... | 2026-09-28 |
| CVE-2026-86335 | medium | 6.3 | No | Missing Authorization in imageDownload in Canonical LXD before 5.0.10, 5.21.8, and 6.10 on Linux allows a project-restricted client to acces... | 2026-09-28 |
| CVE-2026-85185 | critical | 9.6 | No | Path traversal in the btrfs storage driver in Canonical LXD versions 4.0.2 and later (fixed in 4.0.14, 5.0.10, 5.21.8 and 6.10) on Linux all... | 2026-09-28 |
| CVE-2026-80358 | medium | 5.1 | No | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access... | 2026-09-28 |
| CVE-2026-70413 | medium | 5.6 | No | Dell Live Optics Collector, versions prior to 27.2.13.310, contain(s) a Use of Hard-coded Password vulnerability. A low privileged attacker... | 2026-09-28 |
| CVE-2026-82928 | not reported | — | No | mH-DEVELOPER smart home module contains a hardcoded SSH public key in /root/.ssh/authorized_keys, serving as a potential backdoor. The SSH d... | 2026-09-28 |
| CVE-2026-81882 | medium | 6.1 | No | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.0, radare2's binary property-list Unicode parser... | 2026-09-28 |
| CVE-2026-63374 | not reported | — | No | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, connec... | 2026-09-28 |
| CVE-2026-15953 | medium | 5.0 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ABB Protection and control IED manager (PCM6... | 2026-09-28 |
| CVE-2026-100721 | critical | 9.0 | No | vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` wi... | 2026-09-28 |
| CVE-2026-100739 | high | 7.3 | No | A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unkn... | 2026-09-28 |
| CVE-2026-100715 | critical | 9.6 | No | Froxlor through 2.3.10 is vulnerable to arbitrary file deletion via symlink following in the FTP data deletion cron task. Cron task 8 (delet... | 2026-09-28 |
| CVE-2026-100711 | high | 7.5 | No | froxlor versions before 2.3.12 fail to invalidate existing panel sessions, API keys, and 2FA trust cookies when a user password is changed.... | 2026-09-28 |
| CVE-2026-100696 | medium | 5.8 | No | Adminer 4.16.0 through 6.0.1 contain a pre-authentication Server-Side Request Forgery (SSRF) vulnerability in the optional Elasticsearch dri... | 2026-09-28 |
| CVE-2026-100676 | high | 8.2 | No | January, the media proxy/embed service of stoatchat (stoatchat/stoatchat), before version 0.15.5 improperly resolves SVG values as local fil... | 2026-09-28 |
| CVE-2026-100672 | high | 7.5 | No | The Comments plugin (getgrav/grav-plugin-comments) for Grav CMS through version 1.2.10 registers an admin handler that returns comment data... | 2026-09-28 |