Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92730 | not reported | — | No | LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV imp... | 2026-09-23 |
| CVE-2026-92692 | not reported | — | No | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.... | 2026-09-23 |
| CVE-2026-92708 | high | 7.5 | No | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1... | 2026-09-23 |
| CVE-2026-90905 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The e... | 2026-09-23 |
| CVE-2026-90904 | not reported | — | No | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 -... | 2026-09-23 |
| CVE-2026-90903 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.... | 2026-09-23 |
| CVE-2026-90900 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.... | 2026-09-23 |
| CVE-2026-86064 | high | 8.6 | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured... | 2026-09-23 |
| CVE-2026-90899 | not reported | — | No | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checko... | 2026-09-23 |
| CVE-2026-88830 | high | 7.5 | No | A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a pre-authentication heap buffer overflow when processing a cr... | 2026-09-23 |
| CVE-2026-85055 | not reported | — | No | Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.22.0, field-level read permission is enforced on select... | 2026-09-23 |
| CVE-2026-82407 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, core/kapp/validators/validators.go Register and the r... | 2026-09-23 |
| CVE-2026-77601 | high | 8.8 | No | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.12.0 until 7.... | 2026-09-23 |
| CVE-2026-77394 | high | 7.6 | No | OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3... | 2026-09-23 |
| CVE-2026-76910 | not reported | — | No | Unleash is an open-source feature management platform. Prior to 8.0.3, cloneFeatureToggle and POST /api/admin/projects/:projectId/features/:... | 2026-09-23 |
| CVE-2026-55610 | high | 8.7 | No | InvoiceShelf is an open-source web & mobile app that helps track expenses, payments and create professional invoices and estimates. Prior to... | 2026-09-23 |
| CVE-2026-54670 | critical | 9.1 | No | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, the contribution request dispatcher in web/html/contribuicao/controller/... | 2026-09-23 |
| CVE-2026-54506 | high | 7.6 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, app/controller/use... | 2026-09-23 |
| CVE-2026-12751 | medium | 5.4 | No | IBM Cloud Pak for Business Automation is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed... | 2026-09-23 |
| CVE-2026-12750 | medium | 5.4 | No | IBM Cloud Pak for Business Automation is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed... | 2026-09-23 |