Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100376 | not reported | — | No | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki... | 2026-09-28 |
| CVE-2026-100237 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - T... | 2026-09-28 |
| CVE-2026-96795 | high | 8.8 | No | Horilla is an HR and CRM software. Prior to 2.0.0, HorillaListView.export_data in horilla_views/generic/cbv/views.py accepts an authenticate... | 2026-09-28 |
| CVE-2026-63432 | medium | 6.5 | No | Horilla is an HR and CRM software. From 1.0.0 until 1.6.0 and 2.0.0, the get_mail_preview handlers in recruitment/views/actions.py and emplo... | 2026-09-28 |
| CVE-2026-78582 | medium | 6.5 | No | Missing Authorization (CWE-862) in Kibana can lead to unauthorized deletion of data via Exploiting Incorrectly Configured Access Control Sec... | 2026-09-28 |
| CVE-2026-72662 | medium | 6.3 | No | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to unauthorized disclosure, modification, and deletion of data... | 2026-09-28 |
| CVE-2026-82936 | not reported | — | No | mH-DEVELOPER smart home module is vulnerable to Denial of Service due to uncontrolled resource consumption. The Express bodyParser is config... | 2026-09-28 |
| CVE-2026-82935 | not reported | — | No | mH-DEVELOPER smart home module ships with an end-of-life, unsupported Debian 8 and Node.js runtime v17.0.1 in its production firmware. This... | 2026-09-28 |
| CVE-2026-82933 | not reported | — | No | mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device c... | 2026-09-28 |
| CVE-2026-82932 | not reported | — | No | mH-DEVELOPER smart home module does not load any firewall rules at startup. This leaves all listening services, including SSH, HTTP, WebSock... | 2026-09-28 |
| CVE-2026-82930 | not reported | — | No | mH-DEVELOPER smart home module does not verify tokens in its authorization middleware, leaving all HTTP API and WebSocket endpoints accessib... | 2026-09-28 |
| CVE-2026-82929 | not reported | — | No | mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who ex... | 2026-09-28 |
| CVE-2026-52749 | not reported | — | No | The Kaon AR2140X router improperly issues session cookies in responses to unauthenticated HTTP requests. This vulnerability allows a remote... | 2026-09-28 |
| CVE-2026-52748 | not reported | — | No | The Kaon AR2140X router contains a vulnerability where the backup functionality is accessible without authentication. This allows an unauthe... | 2026-09-28 |
| CVE-2026-5267 | high | 7.5 | No | Ciena Navigator Network Control Suite (NCS) contains an information exposure vulnerability in an event-streaming API that does not properly... | 2026-09-28 |
| CVE-2026-18320 | medium | 6.1 | No | Readwise Reader for Android uses a sanitize-html configuration that permits all attributes on SVG and PATH elements due to a wildcard attrib... | 2026-09-28 |
| CVE-2026-18312 | medium | 6.1 | No | Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The appli... | 2026-09-28 |
| CVE-2026-18311 | medium | 6.1 | No | Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported doc... | 2026-09-28 |
| CVE-2026-75907 | high | 7.5 | No | The door access control on a Norwegian Cruise Line asset grants entry based only on the credential's static 7-byte UID stored on an NTAG212... | 2026-09-28 |
| CVE-2026-80359 | medium | 6.8 | No | Dell Boot Optimized Server Storage (BOSS), versions prior to 2.2.13.2038, contains an On-Chip Debug and Test Interface With Improper Access... | 2026-09-28 |