Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54642 | not reported | — | No | CubeCart is an ecommerce software solution. Prior to 6.7.5, the reset_id download-counter action and delete_card stored-payment-card action... | 2026-09-24 |
| CVE-2026-54580 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal... | 2026-09-24 |
| CVE-2026-54579 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, ping() in libmport/ping.c accepted ICMP replies without validating icmp_id or icmp... | 2026-09-24 |
| CVE-2026-54577 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_a... | 2026-09-24 |
| CVE-2026-87900 | not reported | — | No | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute a... | 2026-09-24 |
| CVE-2026-87899 | not reported | — | No | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. | 2026-09-24 |
| CVE-2026-87898 | not reported | — | No | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. | 2026-09-24 |
| CVE-2026-68492 | not reported | — | No | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users... | 2026-09-24 |
| CVE-2026-68490 | not reported | — | No | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. | 2026-09-24 |
| CVE-2026-88344 | high | 7.5 | No | An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema buffer ends with... | 2026-09-24 |
| CVE-2026-92706 | low | 3.4 | No | Dark Reader is an accessibility browser extension that makes web pages colors dark. Prior to 4.9.126, a website can cause the browser extens... | 2026-09-24 |
| CVE-2026-61674 | not reported | — | No | Fluent Bit is a fast and lightweight logs, metrics, and traces processor for Linux, BSD, macOS, and Windows. From 0.11.0 until 5.0.8, plugin... | 2026-09-24 |
| CVE-2026-55563 | not reported | — | No | Feast is the open source feature store for AI and machine learning. Prior to 0.65.0, .github/workflows/pr_integration_tests.yml uses pull_re... | 2026-09-24 |
| CVE-2026-53940 | high | 8.8 | No | Conda is a system-level binary package and environment manager that runs on major operating systems and platforms. Prior to 26.5.2, parse_en... | 2026-09-24 |
| CVE-2026-55567 | high | 7.8 | No | BleachBit cleans files to free disk space and to maintain privacy. Prior to 6.0.1, privileged Windows cleaning does not lock and validate a... | 2026-09-24 |
| CVE-2026-69184 | high | 7.5 | No | c-ares is an asynchronous resolver library. Prior to 1.34.7, ares_dns_name_parse() enforces backward DNS compression pointers but does not b... | 2026-09-24 |
| CVE-2026-77301 | high | 7.5 | No | adm-zip is a JavaScript library for creating and extracting ZIP archives in Node.js. Prior to 0.6.1, getData() in zipEntry.js trusts an entr... | 2026-09-24 |
| CVE-2026-54633 | not reported | — | No | PoDoFo is a C++17 PDF manipulation library. From version 1.0.0 until 1.1.1, processing a crafted PDF with an Indexed color-space image can c... | 2026-09-24 |
| CVE-2026-77281 | medium | 6.5 | No | Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses aff... | 2026-09-24 |
| CVE-2026-50277 | high | 7.5 | No | dd-trace-cpp is the Datadog distributed tracing library for C++. Prior to 2.1.0, dd-trace-cpp parses incoming W3C baggage headers without en... | 2026-09-24 |