Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-56723 | not reported | — | No | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.2, a customer who can view a ticket cannot see internal tic... | 2026-09-28 |
| CVE-2026-77247 | medium | 6.5 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira and Confluence up... | 2026-09-28 |
| CVE-2026-77246 | high | 8.6 | No | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, an HTTP transport depl... | 2026-09-28 |
| CVE-2026-82326 | medium | 4.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Enocta Educational Technologies Inc. E... | 2026-09-28 |
| CVE-2026-82323 | high | 8.1 | No | Authorization bypass through User-Controlled key vulnerability in Enocta Educational Technologies Inc. Enocta Platform allows Exploitation o... | 2026-09-28 |
| CVE-2026-87752 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Rolantis Information Technologies Tour... | 2026-09-28 |
| CVE-2026-85134 | high | 8.8 | No | Unrestricted upload of file with dangerous type vulnerability in Bimser Solution Software Trade Inc. EBA Plus Document and Workflow Manageme... | 2026-09-28 |
| CVE-2026-82969 | medium | 5.4 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Bimser Solution Software Trade Inc. EB... | 2026-09-28 |
| CVE-2026-82915 | medium | 6.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bimser Solution Software Trade Inc. EBA Plus... | 2026-09-28 |
| CVE-2026-86507 | medium | 6.1 | No | Improper neutralization of input in Apache Roller 6.1.5 allows an anonymous remote attacker to store a crafted comment-author URL that can e... | 2026-09-28 |
| CVE-2026-82383 | high | 8.2 | No | Missing Authentication for Critical Function in Apache Roller 6.1.5 allows an unauthenticated remote attacker to persistently change a site-... | 2026-09-28 |
| CVE-2026-82382 | medium | 6.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a remote attacker to perf... | 2026-09-28 |
| CVE-2026-82381 | medium | 5.4 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.5 allows a user with authoring rig... | 2026-09-28 |
| CVE-2026-82380 | high | 8.1 | No | Cross-Site Request Forgery (CSRF) in Apache Roller 6.1.5 allows a remote attacker to cause a logged-in user to perform state-changing action... | 2026-09-28 |
| CVE-2026-82375 | high | 7.4 | No | Server-Side Request Forgery (SSRF) in Apache Roller 6.1.5 allows an authenticated user with entry-editing rights on a weblog to cause outbou... | 2026-09-28 |
| CVE-2026-57449 | not reported | — | No | Actual is a local-first personal finance tool. Prior to 26.7.0, Actual Sync Server's CORS proxy is intended to let authenticated users fetch... | 2026-09-28 |
| CVE-2026-49470 | not reported | — | No | GLPI is a free asset and IT management software package. From 11.0.0 until 11.0.8, the time-based one-time password verification endpoint do... | 2026-09-28 |
| CVE-2026-101068 | medium | 6.5 | No | A security flaw has been discovered in dbgate up to 7.3.1. This impacts the function zipJsonLinesData of the file packages/api/src/utility/z... | 2026-09-28 |
| CVE-2026-100722 | medium | 6.8 | No | vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap... | 2026-09-28 |
| CVE-2026-100419 | high | 7.0 | No | gitoxide gix-fs before 0.23.0 contains a path validation bypass vulnerability in the worktree checkout mechanism that allows attackers to es... | 2026-09-28 |