Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54790 | medium | 6.0 | No | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2, InvoicePlane stores an a... | 2026-09-28 |
| CVE-2026-59563 | medium | 4.6 | No | Zscaler MCP Server versions 0.7.0 and 0.7.1 has an issue where HMAC confirmation tokens were not bound to the target resource identifier, al... | 2026-09-28 |
| CVE-2026-42323 | high | 7.2 | No | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/batch_manager.php accepts administrator-... | 2026-09-28 |
| CVE-2026-42322 | critical | 9.1 | No | Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, admin/themes_standard_pages.php validates uplo... | 2026-09-28 |
| CVE-2026-53493 | not reported | — | No | containerd is an open-source container runtime. Prior to versions 1.7.36, 2.0.13, 2.2.9, 2.3.6, and 2.4.1, a crafted OCI index graph can for... | 2026-09-28 |
| CVE-2026-101069 | medium | 6.5 | No | A weakness has been identified in dbgate up to 7.3.1. Affected is the function exportModelSql of the file packages/api/src/controllers/datab... | 2026-09-28 |
| CVE-2026-101051 | low | 3.1 | No | Cloudreve before 4.16.1 fails to properly sanitize file paths returned by remote downloaders, allowing authenticated users to create files o... | 2026-09-28 |
| CVE-2026-100740 | critical | 9.9 | No | A vulnerability was detected in D-Link DIR-895L A1_102b07. Impacted is the function tunnel_set_params of the file tunnel.c of the component... | 2026-09-28 |
| CVE-2026-100716 | critical | 9.9 | No | Froxlor is a server administration panel. In versions 2.3.10 and earlier, the customer data-export (DataDump) cron fails to validate interme... | 2026-09-28 |
| CVE-2026-100712 | medium | 6.5 | No | froxlor through 2.3.10 disables a user's two-factor authentication immediately upon an unauthenticated-triggerable GET request to the 2FA ma... | 2026-09-28 |
| CVE-2026-100708 | high | 7.1 | No | Froxlor before 2.3.13 returns the ssl_key_file column — which stores the raw PEM TLS private-key content — verbatim in the JSON responses of... | 2026-09-28 |
| CVE-2026-96533 | medium | 5.8 | No | The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the... | 2026-09-28 |
| CVE-2026-96532 | high | 7.5 | No | The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimon... | 2026-09-28 |
| CVE-2026-96531 | medium | 6.8 | No | The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the... | 2026-09-28 |
| CVE-2026-96526 | low | 2.7 | No | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an object-level authorization check on one of its workflow REST... | 2026-09-28 |
| CVE-2026-96525 | low | 2.7 | No | The MCP Server for WordPress WordPress plugin before 1.8.2 does not perform an ownership or sufficient capability check on its workflow crea... | 2026-09-28 |
| CVE-2026-96524 | high | 8.8 | No | The MCP Server for WordPress WordPress plugin before 1.8.2 does not correctly verify the WordPress REST API nonce for cookie-authenticated r... | 2026-09-28 |
| CVE-2026-101072 | critical | 10.0 | No | A vulnerability was identified in Netcore NR289-GE 1.4.5102. This issue affects the function system of the file /ap_ip.cgi of the component... | 2026-09-28 |
| CVE-2026-101055 | medium | 5.3 | No | A security flaw has been discovered in Thinkware U3000 up to 1.02.04. Affected by this vulnerability is the function GET_STATUS of the compo... | 2026-09-28 |
| CVE-2026-101053 | high | 7.3 | No | A vulnerability was determined in Thinkware U3000 up to 1.02.04. This impacts the function PUT_FILE of the file /tmp/wpa_supplicant.conf of... | 2026-09-28 |