Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89013 | high | 7.5 | No | Dolibarr 23.0.4 before 24.0.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read arbitrary files t... | 2026-09-23 |
| CVE-2026-89012 | medium | 6.5 | No | Dolibarr 24.0.0 before 24.0.1 contains a case-sensitive denylist bypass vulnerability in the sqlfilters API query parameter that allows auth... | 2026-09-23 |
| CVE-2026-89011 | high | 7.1 | No | isomorphic-git before 1.42.0 contains a prototype pollution vulnerability in the getRemoteInfo function that allows a malicious Git server o... | 2026-09-23 |
| CVE-2026-86169 | high | 8.8 | No | Axolotl before 0.19.0 contains a remote code execution vulnerability in the multipack patch path where trust_remote_code defaults to None in... | 2026-09-23 |
| CVE-2026-86122 | medium | 5.0 | No | Rowboat through 0.9.1 fails to validate custom MCP server and webhook URLs, allowing authenticated users to configure arbitrary destinations... | 2026-09-23 |
| CVE-2026-86115 | medium | 5.0 | No | Sim before 0.8.14 classifies tool requests as internal based on URL prefix matching without scheme normalization, skipping SSRF validation a... | 2026-09-23 |
| CVE-2026-86114 | medium | 6.5 | No | Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delet... | 2026-09-23 |
| CVE-2026-86098 | high | 7.4 | No | ntop nDPI versions before 6.0 contain a heap buffer overflow vulnerability in the ndpi_json_string_escape function that writes beyond caller... | 2026-09-23 |
| CVE-2026-86091 | high | 7.1 | No | ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to dele... | 2026-09-23 |
| CVE-2026-86090 | high | 7.1 | No | ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-ad... | 2026-09-23 |
| CVE-2026-85691 | high | 7.5 | No | MegaParse 0.0.55 contains an unauthenticated server-side request forgery vulnerability in the POST /v1/url endpoint that fetches caller-supp... | 2026-09-23 |
| CVE-2026-85690 | high | 7.8 | No | Plandex 2.2.1 contains a path traversal vulnerability in the ApplyFiles function that allows attackers to write files outside the project di... | 2026-09-23 |
| CVE-2026-85689 | medium | 6.5 | No | llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer (llmware/resources.py) where filter and lookup values... | 2026-09-23 |
| CVE-2026-85686 | high | 7.5 | No | ms-swift 4.5.2 contains a server-side request forgery vulnerability in the swift deploy OpenAI-compatible API that fetches multimodal media... | 2026-09-23 |
| CVE-2026-85685 | high | 7.5 | No | AgentScope through 2.0.7.post1 contains a path traversal vulnerability in LocalWorkspace.add_skill that copies arbitrary server directories... | 2026-09-23 |
| CVE-2026-85684 | critical | 9.1 | No | marker through 2.0.0 contains a path traversal vulnerability in the FastAPI /marker/upload handler that fails to sanitize the file.filename... | 2026-09-23 |
| CVE-2026-85672 | critical | 9.8 | No | zerox 1.1.20 contains an OS command injection vulnerability in the file download mechanism where the temporary file extension derived from d... | 2026-09-23 |
| CVE-2026-85671 | high | 7.5 | No | QAnything 2.0.0 contains an authentication bypass vulnerability in the /api/local_doc_qa/get_file_base64 and /api/local_doc_qa/get_doc endpo... | 2026-09-23 |
| CVE-2026-84702 | high | 7.5 | No | facefusion through 3.6.1 fails to normalize job identifiers in get_job_file_name, allowing attackers to write files outside the jobs directo... | 2026-09-23 |
| CVE-2026-10144 | high | 7.8 | No | Rsbuild before 2.0.9 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by supplying a crafte... | 2026-09-23 |