Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73175 | not reported | — | No | Nozomi Networks Labs identified a CWE-400: Uncontrolled Resource Consumption vulnerability in the OPC UA gateway component of Advantech EKI-... | 2026-09-23 |
| CVE-2026-73174 | not reported | — | No | Nozomi Networks Labs identified a CWE-319: Cleartext Transmission of Sensitive Information vulnerability in the edgserver management protoco... | 2026-09-23 |
| CVE-2026-73173 | not reported | — | No | Nozomi Networks Labs identified a CWE-306: Missing Authentication for Critical Function vulnerability in the edgserver management protocol o... | 2026-09-23 |
| CVE-2026-73172 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73171 | not reported | — | No | Nozomi Networks Labs identified a CWE-73: External Control of File Name or Path vulnerability in the backup-restore workflow of Advantech EK... | 2026-09-23 |
| CVE-2026-73170 | not reported | — | No | Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the Modbus CSV import w... | 2026-09-23 |
| CVE-2026-73169 | not reported | — | No | Nozomi Networks Labs identified a CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability... | 2026-09-23 |
| CVE-2026-73167 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73166 | not reported | — | No | Nozomi Networks Labs identified a CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability in the web management inte... | 2026-09-23 |
| CVE-2026-73165 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73164 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-73163 | not reported | — | No | Nozomi Networks Labs identified a CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnera... | 2026-09-23 |
| CVE-2026-19535 | not reported | — | No | Nozomi Networks Labs identified a CWE-352: Cross-Site Request Forgery (CSRF) vulnerability in the LuCI administrative web interface of Advan... | 2026-09-23 |
| CVE-2026-92465 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themeum WP Mega Menu allows Blind SQL... | 2026-09-23 |
| CVE-2026-92461 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any lo... | 2026-09-23 |
| CVE-2026-92460 | medium | 6.5 | No | yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-o... | 2026-09-23 |
| CVE-2026-92458 | medium | 4.3 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticate... | 2026-09-23 |
| CVE-2026-92457 | medium | 6.5 | No | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authent... | 2026-09-23 |
| CVE-2026-92456 | high | 7.1 | No | yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any... | 2026-09-23 |
| CVE-2026-92455 | medium | 4.3 | No | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenti... | 2026-09-23 |