Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93426 | high | 8.5 | No | SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticat... | 2026-09-22 |
| CVE-2026-89038 | medium | 6.2 | No | Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 contains a path traversal vulnerability that allows co-resident malicious... | 2026-09-22 |
| CVE-2026-93292 | high | 8.5 | No | SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate servic... | 2026-09-22 |
| CVE-2026-89036 | high | 8.8 | No | Appwrite before 2.0.0 contains an argument injection vulnerability that allows authenticated users with functions.write or sites.write permi... | 2026-09-22 |
| CVE-2026-92599 | high | 7.5 | No | joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in t... | 2026-09-22 |
| CVE-2026-92598 | medium | 6.5 | No | Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute... | 2026-09-22 |
| CVE-2026-92597 | medium | 6.5 | No | Nodemailer versions >= 6.9.16 and < 9.1.0 mis-parse RFC 5322 comments in email addresses: in lib/addressparser, a comment closed immediately... | 2026-09-22 |
| CVE-2026-92596 | high | 7.5 | No | Nodemailer before 9.1.0 contains a quadratic time complexity vulnerability in the addressparser component that allows remote attackers to ca... | 2026-09-22 |
| CVE-2026-92595 | medium | 5.9 | No | Nodemailer (npm package `nodemailer`) versions 9.1.0 and earlier do not honor the `disableFileAccess` and `disableUrlAccess` sandbox options... | 2026-09-22 |
| CVE-2026-92594 | high | 7.5 | No | Craft CMS 5.0.0-RC1 through versions before 5.11.0 incorrectly authorize the GraphQL draftCreator and revisionCreator fields: instead of req... | 2026-09-22 |
| CVE-2026-92593 | high | 8.8 | No | Craft CMS versions 5.10.0 through 5.10.12 contain an incomplete fix for CVE-2026-55794: the Controller::getPostedRedirectUrl() -> View::rend... | 2026-09-22 |
| CVE-2026-92592 | high | 8.8 | No | Craft CMS 4.8.0 through 4.18.5 and 5.0.0 through 5.10.12 sign an authenticated user's attacker-controlled license-shun cookie with the same... | 2026-09-22 |
| CVE-2026-92591 | medium | 5.9 | No | Craft CMS 5.0.0 through 5.10.12 treats a database connection failure as meaning that Craft is not installed, which makes anonymous installer... | 2026-09-22 |
| CVE-2026-92590 | medium | 5.4 | No | Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields feature that disabl... | 2026-09-22 |
| CVE-2026-92589 | medium | 4.3 | No | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an au... | 2026-09-22 |
| CVE-2026-92813 | medium | 4.9 | No | Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attacke... | 2026-09-22 |
| CVE-2026-92792 | high | 7.5 | No | OpenNHP through 1.0.2 selects its trusted-execution attestation verifier based on attacker-supplied evidence containing a test_purpose key,... | 2026-09-22 |
| CVE-2026-78624 | medium | 4.9 | No | The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writ... | 2026-09-22 |
| CVE-2026-95862 | high | 7.5 | No | A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to ex... | 2026-09-22 |
| CVE-2026-95861 | high | 7.5 | No | A malicious actor with access to the network could exploit an Uncontrolled Recursion vulnerability found in certain UniFi gateway devices to... | 2026-09-22 |