Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94107 | high | 8.1 | No | NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes... | 2026-09-22 |
| CVE-2026-94105 | medium | 5.3 | No | NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthent... | 2026-09-22 |
| CVE-2026-93993 | high | 8.8 | No | Mistral Vibe before 2.25.5 contains a remote code execution vulnerability in the worktree creation process that executes git hooks before tr... | 2026-09-22 |
| CVE-2026-93992 | high | 8.1 | No | Gopeed through 2.0.0-beta.3 contains a path traversal vulnerability in archive extraction that allows attackers to write arbitrary files out... | 2026-09-22 |
| CVE-2026-93838 | medium | 5.9 | No | SGLang versions through 0.5.20 contain an unbounded memory allocation vulnerability in handle_staging_req() that fails to validate chunk_idx... | 2026-09-22 |
| CVE-2019-25776 | high | 7.5 | No | Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by sub... | 2026-09-22 |
| CVE-2026-93688 | high | 7.5 | No | SGLang through 0.5.19 in prefill/decode disaggregation mode with Mooncake KV transfer backend fails to validate bootstrap_room values, allow... | 2026-09-22 |
| CVE-2026-81946 | medium | 4.4 | No | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password h... | 2026-09-22 |
| CVE-2026-81944 | high | 7.5 | No | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain a stack-based bu... | 2026-09-22 |
| CVE-2026-81943 | medium | 6.7 | No | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain active debug fun... | 2026-09-22 |
| CVE-2026-81942 | high | 8.8 | No | PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 contain an OS command in... | 2026-09-22 |
| CVE-2026-93660 | medium | 6.5 | No | SQLBot through 1.10.1 fails to verify dashboard ownership in update_resource and update_canvas endpoints, allowing authenticated workspace m... | 2026-09-22 |
| CVE-2026-93453 | high | 8.3 | No | SOGo before 5.12.11 constructs password-reset links using the client-supplied Origin header as the authority, allowing unauthenticated attac... | 2026-09-22 |
| CVE-2026-93014 | high | 7.1 | No | RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users... | 2026-09-22 |
| CVE-2026-92987 | high | 7.5 | No | roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. At... | 2026-09-22 |
| CVE-2026-92972 | high | 8.6 | No | SGLang through 0.5.19 in prefill/decode disaggregation mode contains an unauthenticated PUT /route endpoint on the prefill bootstrap service... | 2026-09-22 |
| CVE-2026-92915 | high | 7.3 | No | WWBN AVideo through commit e01e41ecc (no patched version available) contains a broken access control flaw in objects/userVerifyEmail.php. Th... | 2026-09-22 |
| CVE-2026-92914 | high | 8.1 | No | AVideo LoginControl contains an authentication bypass vulnerability in the PGP second factor verification that compares challenge responses... | 2026-09-22 |
| CVE-2026-92913 | high | 7.4 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 uses a cryptographically weak pseudo-random number generator when creating ac... | 2026-09-22 |
| CVE-2026-92912 | medium | 6.5 | No | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 uses cryptographically weak uniqid() values for RTMP publish keys in LiveTransmition... | 2026-09-22 |