Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92811 | medium | 6.5 | No | browserless versions 1.44.0 through 2.56.7 fail to enforce file protocol restrictions in Playwright websocket endpoints, allowing authentica... | 2026-09-22 |
| CVE-2026-92803 | medium | 5.3 | No | LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated fi... | 2026-09-22 |
| CVE-2026-92802 | medium | 4.3 | No | kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boa... | 2026-09-22 |
| CVE-2026-92800 | medium | 6.8 | No | Docs before 5.4.1 fails to properly revoke websocket collaboration connections when access is revoked at parent documents. Attackers with re... | 2026-09-22 |
| CVE-2026-92796 | high | 8.8 | No | Manticore Search versions 27.0.0 before 28.4.4 fail to validate permissions for all statements in multi-statement SQL requests, allowing rea... | 2026-09-22 |
| CVE-2026-92793 | high | 8.1 | No | GoAdmin through 1.2.26 fails to properly anchor the logout pattern when checking permissions, allowing authenticated users to bypass permiss... | 2026-09-22 |
| CVE-2026-92789 | medium | 6.5 | No | Graylog through 7.1.4 validates outbound URLs against an allowlist before making requests but fails to re-validate after following HTTP redi... | 2026-09-22 |
| CVE-2026-91996 | high | 7.5 | No | lamp-cloud through 5.10.0 whitelists the path pattern /*/anno/** for anonymous access, allowing unauthenticated attackers to read the server... | 2026-09-22 |
| CVE-2026-73753 | high | 8.8 | No | Exploitation through affected command-line operations could allow an authenticated low-privileged user to execute arbitrary commands as a pr... | 2026-09-22 |
| CVE-2026-73759 | medium | 6.5 | No | Vulnerabilities in AOS-CX could allow an unauthenticated remote malicious actor to trigger a denial-of-service condition by sending speciall... | 2026-09-22 |
| CVE-2026-73780 | high | 8.3 | No | A vulnerability in the web-based management interface of AOS-CX switches exposes some sessions to a lack of Cross-Site Request Forgery (CSRF... | 2026-09-22 |
| CVE-2026-43643 | high | 7.5 | No | Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that a... | 2026-09-22 |
| CVE-2026-94501 | high | 8.8 | No | jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to crea... | 2026-09-22 |
| CVE-2026-94497 | high | 8.3 | No | jshERP through 3.6 fails to validate object ownership in by-id info, update, and delete endpoints across multiple resource types. Authentica... | 2026-09-22 |
| CVE-2026-94496 | high | 8.3 | No | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data... | 2026-09-22 |
| CVE-2026-94494 | medium | 5.0 | No | jshERP through 3.6 contains a tenant isolation bypass vulnerability that allows authenticated users to read other tenants' records via the G... | 2026-09-22 |
| CVE-2026-94414 | medium | 5.4 | No | jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modi... | 2026-09-22 |
| CVE-2026-94413 | medium | 6.5 | No | jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 passwor... | 2026-09-22 |
| CVE-2026-94412 | high | 8.8 | No | jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to res... | 2026-09-22 |
| CVE-2026-94111 | medium | 6.6 | No | Tencent BrowserSkill through 0.3.0 contains an authentication bypass vulnerability in the local daemon WebSocket origin validation that acce... | 2026-09-22 |