Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77166 | low | 2.4 | No | The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar... | 2026-09-22 |
| CVE-2026-77165 | medium | 6.5 | No | File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of... | 2026-09-22 |
| CVE-2026-36472 | medium | 5.2 | No | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS). Improper neutralization of the __referer value 2.0.1 allows a remote attacker... | 2026-09-22 |
| CVE-2026-36470 | medium | 5.8 | No | CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php. The value of the "Referer" header is copied into the response HTM... | 2026-09-22 |
| CVE-2026-36468 | medium | 6.1 | No | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL param... | 2026-09-22 |
| CVE-2026-36467 | high | 7.2 | No | Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access... | 2026-09-22 |
| CVE-2026-93894 | not reported | — | No | In Vinyl Cache before 9.0,2, workspace buffer overflow vulnerability was found in the .upper() and .lower() string type methods of VCL. This... | 2026-09-22 |
| CVE-2026-88622 | high | 8.8 | No | NUUO Network Video Recorder 2.0.0 is vulnerable to Command Injection in handle_import_privilege.php. | 2026-09-22 |
| CVE-2026-79294 | medium | 6.1 | No | Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the H... | 2026-09-22 |
| CVE-2026-52483 | high | 8.8 | No | The ping diagnostics and other similar functions of the MitraStar GPT-2741GNAC-N2-SV router with firmware BR_g8.10_1.11(WVK.0)b46 allow auth... | 2026-09-22 |
| CVE-2021-3030 | medium | 6.1 | No | Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colo... | 2026-09-22 |
| CVE-2026-88592 | critical | 9.1 | No | kkFileView >= 4.2.0 is vulnerable to Server-Side Request Forgery (SSRF). The cross-origin file proxy endpoint /getCorsFile is protected by T... | 2026-09-22 |
| CVE-2026-79298 | high | 8.4 | No | An issue in Howyar Technologies Inc SysReturn Versions prior to 11.3.034 and fixed in v.11.3.0.34 allows a local attcker to execute arbitrar... | 2026-09-22 |
| CVE-2026-38999 | high | 7.5 | No | A Null Pointer Dereference in the mk_sched_event_close function (mk_server/mk_scheduler.c) of Monkey through commit 4fb0c16 allows attackers... | 2026-09-22 |
| CVE-2026-88593 | medium | 6.1 | No | kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint. The OnlinePreviewController passes the user-controlled... | 2026-09-22 |
| CVE-2026-51990 | critical | 9.8 | No | An issue in Sogou Sogou Input Method < 16.3.0.3498 (fixed in 16.3.0.3498) allows a remote attacker to execute arbitrary code via the biz_hel... | 2026-09-22 |
| CVE-2026-88743 | medium | 6.1 | No | Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags. | 2026-09-22 |
| CVE-2026-88742 | medium | 5.4 | No | Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field. | 2026-09-22 |
| CVE-2026-51134 | high | 7.5 | No | The C-MOR Video Surveillance web interface (up to version 6.0104) is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml... | 2026-09-22 |
| CVE-2026-51133 | medium | 6.1 | No | Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary cod... | 2026-09-22 |