Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87258 | high | 7.6 | No | Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Folders, Files & Attachments). The supported version that i... | 2026-09-23 |
| CVE-2026-78552 | medium | 4.9 | No | The Okta Access Gateway does not apply its Lua directive restriction to the application-level custom configuration field. The field is inter... | 2026-09-23 |
| CVE-2026-59830 | medium | 5.4 | No | Discourse is an open-source discussion platform. Prior to 2026.7.0, the post action component failed to escape user-controlled display names... | 2026-09-23 |
| CVE-2026-83621 | high | 8.1 | No | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scrip... | 2026-09-23 |
| CVE-2026-94382 | medium | 4.2 | No | Beszel before 0.19.0 contains an insecure direct object reference vulnerability in the POST and DELETE /api/beszel/user-alerts handlers that... | 2026-09-23 |
| CVE-2026-93753 | high | 7.5 | No | deepmerge through 4.3.1 contains a prototype poisoning vulnerability in the mergeObject() function that fails to properly validate keys bein... | 2026-09-23 |
| CVE-2026-96560 | critical | 9.8 | No | LightLLM through 1.2.0 contains a remote code execution vulnerability in the KV-transfer worker when started with --pd_trans_mode nccl, whic... | 2026-09-23 |
| CVE-2026-82412 | high | 8.8 | No | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/... | 2026-09-23 |
| CVE-2026-93750 | medium | 5.9 | No | http-cache-semantics through 4.2.0 contains a cache validation vulnerability in the _varyMatches() function that fails to properly validate... | 2026-09-23 |
| CVE-2026-62282 | medium | 6.5 | No | OpenCVE is a vulnerability intelligence platform. Prior to 3.0.0, OpenCVE notification testing for Webhook and Slack integrations does not s... | 2026-09-23 |
| CVE-2026-53557 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a craft... | 2026-09-23 |
| CVE-2026-53556 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData... | 2026-09-23 |
| CVE-2026-53555 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated uploader can submit an... | 2026-09-23 |
| CVE-2026-53554 | not reported | — | No | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/parseExcel e... | 2026-09-23 |
| CVE-2026-50022 | medium | 5.8 | No | Metacat is data repository software that helps researchers preserve, share, and discover data. Prior to 3.4.2, MetacatSolrIndex.query forwar... | 2026-09-23 |
| CVE-2026-92783 | high | 8.1 | No | Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete... | 2026-09-23 |
| CVE-2026-92778 | medium | 5.4 | No | CMAK through 3.0.0.6 fails to apply the scheduled leader election feature toggle to HTML form routes, allowing attackers to bypass the featu... | 2026-09-23 |
| CVE-2026-92754 | medium | 4.3 | No | PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization deco... | 2026-09-23 |
| CVE-2026-92753 | high | 7.1 | No | PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filte... | 2026-09-23 |
| CVE-2026-92717 | critical | 9.1 | No | Covenant through 0.6 registers the CovenantHub SignalR hub without an Authorize attribute, allowing unauthenticated callers to invoke Create... | 2026-09-23 |