Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88345 | high | 7.5 | No | An out-of-bounds read vulnerability exists in the schema lexer of flatcc 4c3b999e. When an exact-length FlatBuffers schema ends with an unte... | 2026-09-24 |
| CVE-2026-88339 | medium | 5.5 | No | A NULL pointer dereference vulnerability exists in the gf_sg_vrml_field_clone() function of GPAC 2d7da22e (26.08-DEV). The vulnerability occ... | 2026-09-24 |
| CVE-2026-47116 | critical | 9.8 | No | LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where the root and guest account passwords are stored in /etc/shadow as... | 2026-09-24 |
| CVE-2026-94112 | medium | 6.8 | No | mayswind ezBookkeeping before 2.0.0 fails to invalidate TOTP passcodes after use, allowing attackers to replay captured codes within the acc... | 2026-09-24 |
| CVE-2021-48008 | high | 7.5 | No | Chanjet CRM contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by manipul... | 2026-09-24 |
| CVE-2026-93015 | medium | 6.3 | No | BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery.... | 2026-09-24 |
| CVE-2026-92791 | high | 7.5 | No | Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse o... | 2026-09-24 |
| CVE-2026-92787 | critical | 9.8 | No | Feast through 0.66.0 fails to verify JWT token signatures before establishing user identity, allowing attackers to bypass all role-based acc... | 2026-09-24 |
| CVE-2026-92784 | high | 7.5 | No | @refinedev/inferencer through 7.0.0 fails to escape API field names when interpolating them into generated JSX source code. Attackers contro... | 2026-09-24 |
| CVE-2026-92781 | medium | 6.3 | No | Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the unflatten helper that processes... | 2026-09-24 |
| CVE-2026-92779 | high | 7.6 | No | Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that pr... | 2026-09-24 |
| CVE-2026-92762 | high | 8.8 | No | Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side aut... | 2026-09-24 |
| CVE-2026-92759 | medium | 6.5 | No | SecObserve versions before 1.59.1 contain an information disclosure vulnerability in the ApiConfigurationSerializer that fails to strip the... | 2026-09-24 |
| CVE-2026-92720 | critical | 9.1 | No | Kubero through 3.1.1 fails to apply authentication guards to the notifications API endpoints, allowing unauthenticated attackers to read web... | 2026-09-24 |
| CVE-2026-92605 | medium | 6.5 | No | IRIS through 2.4.29 fails to properly validate case authorization in comment listing endpoints for notes, tasks, IOCs, assets, and evidence... | 2026-09-24 |
| CVE-2026-47094 | high | 8.8 | No | SIMAC MyPHR 1.1 contains an insecure direct object reference (IDOR) vulnerability that allows authenticated attackers to access and modify a... | 2026-09-24 |
| CVE-2026-92603 | medium | 6.5 | No | ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticate... | 2026-09-24 |
| CVE-2026-92602 | high | 7.1 | No | TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated... | 2026-09-24 |
| CVE-2026-92569 | medium | 4.3 | No | Hippo4j through 1.5.0 contains a server-side request forgery vulnerability in four ThreadPoolController endpoints that fail to validate the... | 2026-09-24 |
| CVE-2026-92567 | medium | 6.5 | No | TDuck survey form through version 5.0 contains an authorization bypass vulnerability in the POST /user/form/data/update endpoint that allows... | 2026-09-24 |