Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96762 | high | 7.3 | No | A vulnerability was determined in kvcache-ai mooncake up to 0.3.12/0.3.13.post1. This affects the function UnmountSegment of the component R... | 2026-09-24 |
| CVE-2026-96751 | high | 7.3 | No | A vulnerability has been found in pmTicket Project-Management-Software up to 078fa56a782490c5059a0814f84df27984f4d7e2. This affects the func... | 2026-09-24 |
| CVE-2026-96739 | medium | 4.3 | No | A flaw has been found in SEMCMS up to 4.2. Affected by this issue is some unknown functionality of the file /Edit/php/upload_json.php of the... | 2026-09-24 |
| CVE-2026-96680 | medium | 4.3 | No | A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.... | 2026-09-24 |
| CVE-2026-96676 | medium | 6.3 | No | A vulnerability was identified in Fast FAC1900R 20190827_2.0.2. The impacted element is the function get_alias_name of the component uhttpd.... | 2026-09-24 |
| CVE-2026-96604 | high | 7.3 | No | A vulnerability was identified in SoftNews Media Group DataLife Engine 18.0. This affects the function strip_data of the file engine/modules... | 2026-09-24 |
| CVE-2026-93352 | critical | 9.8 | No | Laravel-Mediable 7.0.0 before 7.0.2 contains an incomplete patch for CVE-2026-49972 in which the .pht extension is absent from the forbidden... | 2026-09-24 |
| CVE-2026-96675 | low | 3.3 | No | alsa-lib through 1.2.16.1 contains a denial of service vulnerability in the multi PCM plugin that fails to validate sparse binding indices b... | 2026-09-24 |
| CVE-2026-96674 | medium | 4.4 | No | alsa-lib through 1.2.16.1 computes combined topology element size using 32-bit arithmetic in src/topology/ctl.c, allowing integer overflow t... | 2026-09-24 |
| CVE-2026-96673 | high | 7.5 | No | Photoview through 2.4.0 contains an SQL injection vulnerability in the album download route that allows unauthenticated attackers to inject... | 2026-09-24 |
| CVE-2026-96609 | not reported | — | No | Robur Albatross 1.0.0 through 2.x before 2.7.2 does not limit use of the ring buffer, leading to an albatross-console loop with no recognize... | 2026-09-24 |
| CVE-2026-96600 | medium | 5.5 | No | Isotope eCommerce through 2.9.10 contains a blind SQL injection vulnerability in backend callbacks that interpolate request-controlled ident... | 2026-09-24 |
| CVE-2026-96599 | medium | 5.9 | No | Isotope eCommerce through 2.9.10 derives order identifiers from uniqid() instead of a cryptographically secure source, allowing unauthentica... | 2026-09-24 |
| CVE-2026-96271 | high | 7.1 | No | Photoview through 2.4.0 contains an authorization bypass vulnerability in the shareAlbum GraphQL mutation that allows authenticated users to... | 2026-09-24 |
| CVE-2026-92930 | medium | 6.2 | No | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design that lacks a per-device... | 2026-09-24 |
| CVE-2026-92929 | medium | 5.3 | No | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determini... | 2026-09-24 |
| CVE-2026-92928 | medium | 6.5 | No | OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential th... | 2026-09-24 |
| CVE-2026-95815 | medium | 6.3 | No | OpenClaw iOS before 2026.8.11 logs complete agent deep-link URLs including persistent bearer keys to unified logs as public diagnostic data.... | 2026-09-24 |
| CVE-2026-95812 | medium | 6.1 | No | ClipBucket v5 before 5.5.3-#182 contains a reflected cross-site scripting vulnerability in the sort_link() helper function that fails to san... | 2026-09-24 |
| CVE-2026-88624 | critical | 9.1 | No | Missing path validation in the Worktree.remove component of openCode v1.18.26 allows attackers to execute arbitrary recursive directory dele... | 2026-09-24 |