Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90930 | medium | 6.8 | No | File Browser through 2.63.23 applies path rules to the requested lexical path but resolves symbolic links without reapplying rules to the ta... | 2026-09-24 |
| CVE-2026-90929 | high | 8.1 | No | File Browser versions >= 2.5.0 and <= 2.63.23 contain an incorrect authorization flaw in the direct-upload endpoint (resourcePostHandler in... | 2026-09-24 |
| CVE-2026-90928 | medium | 6.5 | No | File Browser through 2.63.23 contains a memory exhaustion vulnerability in the subtitle conversion endpoint that loads entire subtitle files... | 2026-09-24 |
| CVE-2026-90771 | low | 3.7 | No | joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __prot... | 2026-09-24 |
| CVE-2026-57842 | high | 7.0 | No | NetBSD contains a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer due to a... | 2026-09-24 |
| CVE-2026-89147 | high | 7.5 | No | Net-SNMP through 5.9.5.2 contains a denial of service vulnerability in the SMUX module where smux_accept() performs an unauthenticated block... | 2026-09-24 |
| CVE-2026-85620 | high | 8.6 | No | Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes... | 2026-09-24 |
| CVE-2026-79787 | critical | 9.8 | No | Alluxio's S3 REST proxy fails to verify AWS Signature Version 4 signatures in its default configuration, allowing unauthenticated attackers... | 2026-09-24 |
| CVE-2026-13249 | critical | 9.8 | No | An unauthenticated Remote Code Execution via Arbitrary File Upload vulnerability in the web management interface in Honeywell PD45 Industria... | 2026-09-24 |
| CVE-2026-13248 | high | 8.8 | No | An Authenticated Remote Code Execution via Arbitrary File Write in the Intermec Fingerprint Command Interface vulnerability in the web manag... | 2026-09-24 |
| CVE-2026-12559 | not reported | — | No | A Stored Cross-Site Scripting (XSS) vulnerability has been identified in OpenText Vendor Invoice Management for SAP Solutions Capture Valida... | 2026-09-24 |
| CVE-2026-4638 | not reported | — | No | PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. I... | 2026-09-24 |
| CVE-2026-4637 | not reported | — | No | Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a reque... | 2026-09-24 |
| CVE-2026-96770 | not reported | — | No | All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClien... | 2026-09-24 |
| CVE-2026-91777 | high | 7.5 | No | Forward-reference completion for @JsonIdentityInfo object IDs in FasterXML jackson-databind performs a linear scan of the pending-reference... | 2026-09-24 |
| CVE-2026-91776 | high | 7.5 | No | TypeDeserializerBase._findDeserializer() in FasterXML jackson-databind caches the resolved deserializer under the raw, attacker-supplied typ... | 2026-09-24 |
| CVE-2026-89425 | high | 7.5 | No | UTF8DataInputJsonParser._reportInvalidToken() in FasterXML jackson-core builds the offending-token text for its error message by appending J... | 2026-09-24 |
| CVE-2026-89030 | medium | 4.3 | No | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accoun... | 2026-09-24 |
| CVE-2023-54398 | critical | 9.8 | No | Yonyou U8 Cloud contains an unauthenticated Java deserialization vulnerability in the nc.impl.pub.filesystem.FileManageServlet component tha... | 2026-09-24 |
| CVE-2026-91988 | high | 8.1 | No | atomic-agents-stack before 1.1.0 accepts cleartext HTTP schemes in the HTTP MCP server-registry backend factory, allowing network man-in-the... | 2026-09-24 |