Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92773 | high | 7.1 | No | Trigger.dev before 4.6.0 fails to verify that an authenticated user controls a GitHub App installation before binding it to their organizati... | 2026-09-23 |
| CVE-2026-92771 | medium | 6.5 | No | Twenty before 2.35.0 fails to validate field and row permissions in the groupBy-with-records GraphQL resolver, allowing authenticated users... | 2026-09-23 |
| CVE-2026-92761 | high | 8.8 | No | WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Att... | 2026-09-23 |
| CVE-2026-92760 | medium | 6.5 | No | Shlink through 5.1.6 fails to enforce API key role restrictions when issuing Mercure subscription tokens, allowing restricted keys to subscr... | 2026-09-23 |
| CVE-2026-92752 | high | 8.3 | No | metasfresh DocumentAttachmentsRestController and CommentsRestController endpoints check only that callers are logged in without enforcing re... | 2026-09-23 |
| CVE-2026-92751 | high | 8.1 | No | CMAK through 3.0.0.6 fails to install a cross-site request forgery filter, allowing attackers to perform state-changing actions on behalf of... | 2026-09-23 |
| CVE-2026-92749 | high | 8.1 | No | SafeLine through 9.4.1 derives the management console session-signing secret from a time-seeded math/rand generator, allowing attackers to r... | 2026-09-23 |
| CVE-2026-92600 | medium | 6.5 | No | Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints o... | 2026-09-23 |
| CVE-2026-92568 | medium | 5.4 | No | MLRun through 1.11.0 contains a server-side request forgery vulnerability in the WebhookNotification handler that allows authenticated users... | 2026-09-23 |
| CVE-2026-92566 | high | 8.2 | No | DataGear through 6.0.0 contains a server-side request forgery vulnerability in the /dataSet/preview/Http endpoint that allows unauthenticate... | 2026-09-23 |
| CVE-2026-92565 | medium | 5.3 | No | Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee n... | 2026-09-23 |
| CVE-2026-76834 | high | 8.1 | No | b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_ch... | 2026-09-23 |
| CVE-2026-91937 | high | 7.5 | No | Flowise before 3.1.4 fails to sanitize the overrideConfig.sessionId parameter before using it in MongoDB queries within the MongoDBMemory no... | 2026-09-23 |
| CVE-2026-91931 | high | 8.5 | No | Flowise before 3.1.4 contains a remote code execution vulnerability in the Custom MCP node that allows authenticated attackers to execute ar... | 2026-09-23 |
| CVE-2026-91930 | high | 7.5 | No | Flowise before 3.1.4 fails to scope enterprise organization and workspace membership APIs to the caller's tenant, allowing authenticated use... | 2026-09-23 |
| CVE-2026-91929 | high | 7.1 | No | Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before... | 2026-09-23 |
| CVE-2026-91774 | medium | 4.3 | No | Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team... | 2026-09-23 |
| CVE-2026-91772 | medium | 6.1 | No | Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query paramet... | 2026-09-23 |
| CVE-2026-91770 | medium | 6.5 | No | IceHRM before 36.0.0 fails to validate employee ownership on seven REST sub-resource endpoints, allowing authenticated employees to read any... | 2026-09-23 |
| CVE-2026-91750 | medium | 6.5 | No | WeKnora before 0.7.0 fails to re-validate HTTP redirect targets in the POST /api/v1/knowledge-bases/:id/knowledge/url endpoint when download... | 2026-09-23 |