Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75699 | critical | 10.0 | No | Adobe Campaign Classic (ACC) is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in... | 2026-09-26 |
| CVE-2026-16591 | high | 7.2 | No | The WP Directory Kit WordPress plugin before 1.5.8 does not sanitize and escape some of its category and location fields before outputting t... | 2026-09-26 |
| CVE-2026-71178 | low | 3.7 | No | Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains an Use of Non-Canonical URL Paths for Authorization... | 2026-09-26 |
| CVE-2026-100720 | high | 8.7 | No | Froxlor 2.0.0 through 2.3.10 is vulnerable to stored cross-site scripting. When a customer (the lowest-privileged authenticated role) upload... | 2026-09-26 |
| CVE-2026-100719 | medium | 6.5 | No | Froxlor versions before 2.3.12 contain a credential disclosure vulnerability in the DirProtections.listing API command that returns htpasswd... | 2026-09-26 |
| CVE-2026-100718 | high | 7.1 | No | Froxlor through 2.3.10 does not enforce the mail.allow_external_domains policy in the EmailSender.add API command. When an administrator has... | 2026-09-26 |
| CVE-2026-100714 | critical | 9.1 | No | Froxlor before 2.3.12 does not restrict or escape the system.letsencryptchallengepath setting: unlike sibling settings hardened in GHSA-33mp... | 2026-09-26 |
| CVE-2026-100713 | high | 7.8 | No | Froxlor 2.3.10 and earlier contain a time-of-check time-of-use (TOCTOU) race condition in the SSH key synchronization cron (lib/Froxlor/Cron... | 2026-09-26 |
| CVE-2026-100710 | medium | 4.9 | No | Froxlor through 2.3.10 does not filter sensitive columns from API responses: Domains::get(), Domains::listing(), SubDomains::get(), and the... | 2026-09-26 |
| CVE-2024-13342 | critical | 9.8 | No | The Booster for WooCommerce plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'add_fil... | 2026-09-26 |
| CVE-2026-95811 | medium | 6.5 | No | Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent... | 2026-09-26 |
| CVE-2026-92957 | critical | 9.9 | No | vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM... | 2026-09-26 |
| CVE-2026-80152 | critical | 9.1 | No | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware ver... | 2026-09-26 |
| CVE-2026-80151 | critical | 9.1 | No | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware ver... | 2026-09-26 |
| CVE-2026-80150 | high | 7.5 | No | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware ver... | 2026-09-26 |
| CVE-2026-80149 | high | 8.6 | No | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware ver... | 2026-09-26 |
| CVE-2026-81945 | medium | 6.6 | No | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based bu... | 2026-09-26 |
| CVE-2026-80148 | high | 8.6 | No | Lantronix SLC8000 before firmware v9.7.0.3, SLC9000 before firmware v9.7.0.2, EMG8500/EMG7500 before firmware v9.7.0.1, and all firmware ver... | 2026-09-26 |
| CVE-2026-94367 | high | 7.2 | No | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated a... | 2026-09-26 |
| CVE-2026-96749 | high | 8.4 | No | An integer overflow in the BSON document encoding component of the MongoDB Python Driver's bundled native extension may occur when a single... | 2026-09-26 |