Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93736 | medium | 4.3 | No | Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any u... | 2026-09-22 |
| CVE-2026-93657 | high | 7.5 | No | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip()... | 2026-09-22 |
| CVE-2026-77929 | high | 8.8 | No | ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by upl... | 2026-09-22 |
| CVE-2026-77928 | medium | 6.5 | No | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database c... | 2026-09-22 |
| CVE-2026-77927 | medium | 6.5 | No | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from... | 2026-09-22 |
| CVE-2026-93456 | high | 8.2 | No | django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge r... | 2026-09-22 |
| CVE-2026-93455 | medium | 6.5 | No | django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitra... | 2026-09-22 |
| CVE-2026-93454 | medium | 5.4 | No | Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated u... | 2026-09-22 |
| CVE-2026-92980 | high | 7.2 | No | HortusFox-Web prior to version 6.1 contains a remote code execution vulnerability that allows authenticated administrators to execute arbitr... | 2026-09-22 |
| CVE-2026-92984 | high | 8.1 | No | HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthent... | 2026-09-22 |
| CVE-2026-92983 | high | 7.5 | No | InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses... | 2026-09-22 |
| CVE-2026-92971 | high | 7.5 | No | InternLM LMDeploy through 0.17.0 contains a reachable assertion vulnerability in the DistServe decode migration loop that allows unauthentic... | 2026-09-22 |
| CVE-2026-92970 | high | 8.8 | No | HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members... | 2026-09-22 |
| CVE-2026-92921 | medium | 4.9 | No | admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attacker... | 2026-09-22 |
| CVE-2026-92920 | medium | 5.4 | No | admin3 through 3.0.0 fails to invalidate existing sessions when disabling a user account, allowing attackers to retain authenticated access... | 2026-09-22 |
| CVE-2026-92919 | high | 8.1 | No | admin3 through 3.0.0 fails to sanitize client-supplied filenames in the upload handler, allowing authenticated users to write files outside... | 2026-09-22 |
| CVE-2026-92918 | high | 8.8 | No | admin3 through 3.0.0 persists user session tokens in the audit log event body when publishing UserLoggedIn domain events. Attackers with log... | 2026-09-22 |
| CVE-2026-92816 | high | 7.8 | No | ComfyUI before 0.30.0 fails to sanitize folder_name input in dataset save nodes, allowing attackers to write files to arbitrary paths outsid... | 2026-09-22 |
| CVE-2026-92815 | high | 7.5 | No | changedetection.io through 0.60.6 fails to validate the Goto URL action in browser steps, allowing unauthenticated attackers to access inter... | 2026-09-22 |
| CVE-2026-92814 | medium | 4.2 | No | changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attacke... | 2026-09-22 |