Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84448 | medium | 4.0 | No | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, the public heif_region_item_add_region_inline_mask_data() funct... | 2026-09-24 |
| CVE-2026-81182 | medium | 4.2 | No | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, an unauthenticated attacker who holds a public read-write no... | 2026-09-24 |
| CVE-2026-79304 | medium | 6.5 | No | CyberPanel 1.9.1 contains a path traversal vulnerability in the readFileContents method of the /filemanager/controller endpoint. An authenti... | 2026-09-24 |
| CVE-2026-76899 | medium | 5.7 | No | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POS... | 2026-09-24 |
| CVE-2026-73863 | not reported | — | No | NanoMQ is an MQTT broker. Prior to 0.24.14, NanoMQ's broker-side MQTT v5 nmq_subinfo_decode() function in nng/src/sp/protocol/mqtt/mqtt_pars... | 2026-09-24 |
| CVE-2026-71537 | medium | 6.5 | No | Paymenter is a free and open-source webshop solution for management of hosting services. Prior to 1.5.7, app/Livewire/Services/Upgrade.php::... | 2026-09-24 |
| CVE-2026-69190 | medium | 6.3 | No | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and da... | 2026-09-24 |
| CVE-2026-55870 | not reported | — | No | GoCD is a continuous deliver server. Prior to 26.1.0, GoCD can return unmasked credentials that administrators stored in the userinfo portio... | 2026-09-24 |
| CVE-2026-55071 | high | 8.4 | No | MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_in... | 2026-09-24 |
| CVE-2026-55060 | low | 3.7 | No | GoCD is a continuous deliver server. From 13.1.0 until 26.1.0, the /go/api/support/process_list endpoint does not enforce its intended admin... | 2026-09-24 |
| CVE-2026-52742 | not reported | — | No | GoCD is a continuous deliver server. From 12.3.1 until 26.1.0, legacy routes under /go/admin/restful/* expose historical full server configu... | 2026-09-24 |
| CVE-2026-52740 | not reported | — | No | GoCD is a continuous deliver server. From 18.7.0 until 26.1.0, the Get Template Config API compares HTTP method names case-sensitively when... | 2026-09-24 |
| CVE-2026-61552 | high | 7.2 | No | Icinga 2 is an open source monitoring system. From 2.4 until 2.14.9, 2.15.4, and 2.16.2, the /v1/objects API writes attacker-controlled temp... | 2026-09-24 |
| CVE-2026-61551 | high | 8.6 | No | Icinga 2 is an open source monitoring system. Prior to 2.14.9, 2.15.4, and 2.16.2, parsing deeply nested JSON can exhaust the call stack bec... | 2026-09-24 |
| CVE-2026-61550 | critical | 9.8 | No | Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does n... | 2026-09-24 |
| CVE-2026-53534 | not reported | — | No | JabRef is a desktop application for managing BibTeX and BibLaTeX libraries. Prior to 6.0-alpha.6, when jabsrv or JabRef's built-in HTTP serv... | 2026-09-24 |
| CVE-2026-68956 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP ssh allows an authenticated remote attacker to exhaust node... | 2026-09-24 |
| CVE-2026-65634 | not reported | — | No | Inefficient algorithmic complexity in the Erlang/OTP asn1 OBJECT IDENTIFIER decoder allows a remote unauthenticated attacker to cause denial... | 2026-09-24 |
| CVE-2026-61822 | medium | 6.5 | No | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, run_maintenance() handles exceptions out... | 2026-09-24 |
| CVE-2026-54647 | high | 7.2 | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-con... | 2026-09-24 |