Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94611 | high | 8.1 | No | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik API serializers return stored credential... | 2026-09-24 |
| CVE-2026-79764 | high | 7.7 | No | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /h... | 2026-09-24 |
| CVE-2026-79763 | medium | 5.3 | No | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.4.0 until 2.5.1, the PO... | 2026-09-24 |
| CVE-2026-79758 | medium | 5.4 | No | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authen... | 2026-09-24 |
| CVE-2026-91187 | not reported | — | No | Improper Verification of Cryptographic Signature vulnerability in dashbit nimble_zta allows an unauthenticated remote attacker to authentica... | 2026-09-24 |
| CVE-2026-78313 | medium | 6.5 | No | Improper Access Control in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | 2026-09-24 |
| CVE-2026-78312 | critical | 9.1 | No | Path Traversal in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | 2026-09-24 |
| CVE-2026-78311 | high | 8.8 | No | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | 2026-09-24 |
| CVE-2026-78310 | medium | 4.3 | No | Authorization Bypass Through User-Controlled Key in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | 2026-09-24 |
| CVE-2026-76902 | medium | 5.0 | No | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter... | 2026-09-24 |
| CVE-2026-63646 | not reported | — | No | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET /mcp/fo... | 2026-09-24 |
| CVE-2026-81455 | high | 8.6 | No | Dell ThinOS 10, versions prior to SecurityAddon_2605.10.2766_T10, contain a Missing Authentication for Critical Function vulnerability. An u... | 2026-09-24 |
| CVE-2026-65422 | medium | 6.5 | No | A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to gener... | 2026-09-24 |
| CVE-2026-77707 | medium | 5.9 | No | Improper certificate validation vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This issue affect... | 2026-09-24 |
| CVE-2026-77703 | medium | 5.9 | No | Key exchange without entity authentication vulnerability in HAVELSAN Inc. Liman Render Engine allows Adversary in the Middle (AiTM). This i... | 2026-09-24 |
| CVE-2026-88916 | medium | 6.8 | No | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Privilege Escalation. This issue affects UlakPDF: through 09092026. | 2026-09-24 |
| CVE-2026-88907 | high | 7.4 | No | Incorrect Authorization vulnerability in TÜBİTAK ULAKBİM UlakPDF allows Authentication Bypass. This issue affects UlakPDF: through 09092026... | 2026-09-24 |
| CVE-2026-19532 | medium | 5.3 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversa... | 2026-09-24 |
| CVE-2026-95985 | high | 8.8 | No | The file write tool in Amazon Kiro IDE versions before 1.0.242 might allow remote unauthenticated actors to inject crafted instructions into... | 2026-09-24 |
| CVE-2026-58008 | high | 8.1 | No | Stack-based buffer overflow vulnerability in Altera Trusted Firmware on HPS allows Exploitation of Improperly Configured or Implemented Memo... | 2026-09-24 |