Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-65393 | medium | 5.5 | No | A permissions issue was addressed with improved validation. This issue is fixed in Xcode 27, macOS Golden Gate 27. An app may be able to acc... | 2026-09-22 |
| CVE-2026-44756 | critical | 10.0 | No | A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticat... | 2026-09-22 |
| CVE-2026-18730 | high | 7.4 | No | A server-side request forgery (SSRF) vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated attacker to ca... | 2026-09-22 |
| CVE-2026-93839 | critical | 9.8 | No | LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated at... | 2026-09-22 |
| CVE-2026-73749 | critical | 9.8 | No | Multiple vulnerabilities exist in a daemon of AOS-CX that may allow for improper processing of malformed input. An unauthenticated remote at... | 2026-09-22 |
| CVE-2026-73750 | high | 8.8 | No | Vulnerabilities exist in the authentication module that may improperly process malformed or truncated input. An authenticated remote attacke... | 2026-09-22 |
| CVE-2026-73751 | high | 8.8 | No | An authenticated user with low-privileged access could submit crafted input through the web-based management interface to execute arbitrary... | 2026-09-22 |
| CVE-2026-73752 | high | 8.8 | No | An unauthenticated arbitrary file write vulnerability exists in an API endpoint of AOS-CX. Successful exploitation of this vulnerability all... | 2026-09-22 |
| CVE-2026-63104 | high | 8.1 | No | Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or... | 2026-09-22 |
| CVE-2026-93344 | medium | 6.5 | No | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action... | 2026-09-22 |
| CVE-2026-93341 | medium | 4.3 | No | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that... | 2026-09-22 |
| CVE-2026-94535 | high | 7.1 | No | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to d... | 2026-09-22 |
| CVE-2026-94534 | high | 7.1 | No | lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated a... | 2026-09-22 |
| CVE-2026-94533 | medium | 6.5 | No | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download... | 2026-09-22 |
| CVE-2026-93873 | medium | 4.3 | No | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Att... | 2026-09-22 |
| CVE-2026-93872 | high | 7.5 | No | Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction.... | 2026-09-22 |
| CVE-2026-93871 | medium | 5.4 | No | Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page cr... | 2026-09-22 |
| CVE-2026-93870 | medium | 4.3 | No | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf o... | 2026-09-22 |
| CVE-2026-93869 | medium | 6.1 | No | Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a r... | 2026-09-22 |
| CVE-2026-93868 | high | 8.1 | No | Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable tok... | 2026-09-22 |