Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92586 | medium | 4.3 | No | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment functi... | 2026-09-22 |
| CVE-2026-92585 | medium | 4.3 | No | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, a... | 2026-09-22 |
| CVE-2026-92584 | medium | 6.1 | No | AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticated view-counter endp... | 2026-09-22 |
| CVE-2026-92583 | medium | 6.5 | No | AVideo through 29.0 contains a race condition in the enforceRateLimit() function that fails to atomically increment rate limit counters, all... | 2026-09-22 |
| CVE-2026-92582 | high | 7.1 | No | AVideo (WWBN/AVideo) through 29.0 (commit e01e41ecc) is vulnerable to cross-site request forgery. objects/videoAddNew.json.php disables AVid... | 2026-09-22 |
| CVE-2026-92581 | medium | 4.3 | No | In AVideo through 29.0, Like::__construct() performs counter arithmetic on raw request values before validation, allowing array-typed parame... | 2026-09-22 |
| CVE-2026-92580 | high | 8.8 | No | In AVideo through 29.0, the CloneSite plugin is vulnerable to stored OS command injection. In plugin/CloneSite/cloneClient.json.php (line ~2... | 2026-09-22 |
| CVE-2026-92579 | medium | 5.4 | No | In AVideo through 29.0, the autoCSRFGuard() function maintains a hardcoded allowlist of exempt basenames tested without directory context, a... | 2026-09-22 |
| CVE-2026-92578 | high | 8.1 | No | WWBN AVideo through 29.0 contains an authentication bypass vulnerability where the stored password hash is accepted as a valid login credent... | 2026-09-22 |
| CVE-2026-92577 | high | 7.5 | No | In AVideo through 29.0, the API get_api_video endpoint contains a broken access control vulnerability in the clean_title branch that returns... | 2026-09-22 |
| CVE-2026-89034 | medium | 6.5 | No | TCH QRing smart ring model R20_B006 running firmware RT09R20_1.00.00_250318 contains an unauthenticated Bluetooth Low Energy access vulnerab... | 2026-09-22 |
| CVE-2026-92810 | medium | 4.3 | No | PrestaShop blockwishlist through 3.0.2 fails to validate wishlist ownership in the getUrlByIdWishListAction method, allowing authenticated c... | 2026-09-22 |
| CVE-2026-92809 | medium | 4.3 | No | PrestaShop psgdpr versions through 1.4.3 fail to validate that GDPR consent log entries are attributed to the authenticated customer. Authen... | 2026-09-22 |
| CVE-2026-92806 | high | 8.1 | No | phpList versions before 3.6.17 fail to validate cross-site request forgery tokens in the mass subscriber removal form handler. Attackers can... | 2026-09-22 |
| CVE-2026-92805 | critical | 9.8 | No | UVdesk Community Skeleton through 1.1.8 fails to authenticate or validate installation state on wizard endpoints in ConfigureHelpdesk contro... | 2026-09-22 |
| CVE-2026-92804 | high | 7.1 | No | Nango through 0.70.4 fails to validate caller-supplied connection configuration values interpolated into provider token and proxy URL templa... | 2026-09-22 |
| CVE-2026-92794 | high | 7.5 | No | OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled.... | 2026-09-22 |
| CVE-2026-78620 | medium | 4.9 | No | The Okta Access Gateway Kerberos configuration handler does not validate file paths specified in event payloads before writing file contents... | 2026-09-22 |
| CVE-2026-93338 | medium | 5.3 | No | Grandstream GWN7660ELR before firmware version 1.0.27.6 contains an information disclosure vulnerability that allows unauthenticated remote... | 2026-09-22 |
| CVE-2026-93737 | medium | 6.5 | No | Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any... | 2026-09-22 |