Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79411 | high | 8.8 | No | Incorrect privilege assignment in the admin user-management component of Webkul Bagisto 2.4.9 allows an authenticated backend user holding o... | 2026-09-22 |
| CVE-2026-79410 | high | 8.1 | No | Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce thei... | 2026-09-22 |
| CVE-2026-79409 | medium | 6.5 | No | An issue in Webkul Bagisto 2.4.9 allows a remote attacker to obtain sensitive information via the add-to-cart API and the downloadable fulfi... | 2026-09-22 |
| CVE-2026-52484 | high | 8.8 | No | An issue in MitraStar GPT-2742GX4X5v6-SV GL_g2.5_100XNT0b23_3 allows an authenticated attacker to execute arbitrary code via the /cgi-bin/de... | 2026-09-22 |
| CVE-2026-39040 | medium | 5.4 | No | BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in Expre... | 2026-09-22 |
| CVE-2026-39039 | medium | 5.3 | No | In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the brow... | 2026-09-22 |
| CVE-2026-39038 | medium | 6.1 | No | BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in Gener... | 2026-09-22 |
| CVE-2026-88621 | low | 2.7 | No | OneNav v1.2.4 contains an authenticated arbitrary file deletion vulnerability in the Api::upload() method in class/Api.php. An authenticated... | 2026-09-22 |
| CVE-2026-88620 | medium | 4.3 | No | SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The en... | 2026-09-22 |
| CVE-2026-88619 | high | 8.1 | No | 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobControll... | 2026-09-22 |
| CVE-2026-37152 | critical | 9.8 | No | TOTOLINK X5000R V9.1.0cu.2415_B20250515 was discovered to contain a hardcoded password for root access. | 2026-09-22 |
| CVE-2026-88618 | medium | 6.5 | No | 1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality. This allows a remote atta... | 2026-09-22 |
| CVE-2026-88617 | critical | 9.8 | No | SmartAdmin v3.30.0 contains an authorization flaw in the configuration query endpoint. This allows a remote attacker to escalate privileges. | 2026-09-22 |
| CVE-2026-88616 | high | 8.8 | No | An issue in RuoYi-Vue-Plus 6.0.0 allows a remote attacker to execute arbitrary code via the FlwTaskController.java component, and the FlwTas... | 2026-09-22 |
| CVE-2026-79551 | high | 7.5 | No | Tenda Technology Co., Ltd NVR_4H CH3 v2.1 V27.5.58.6 was discovered to contain a hardcoded cryptographic key. | 2026-09-22 |
| CVE-2026-79425 | high | 8.1 | No | An authenticated Server-Side Request Forgery (SSRF) in the /adminapi/file/online_upload component of CRMEB v6.0.0 allows attackers to scan i... | 2026-09-22 |
| CVE-2026-79303 | critical | 9.9 | No | kaiten from 57.192.20 to before 57.214.26 is vulnerable to SQL Injection. Dynamic SQL statements are generated without the required data val... | 2026-09-22 |
| CVE-2023-50462 | medium | 5.3 | No | An issue was discovered in the content_consent (aka Content Consent) extension through 2.0.1 for TYPO3. It fails to verify whether a specifi... | 2026-09-22 |
| CVE-2023-50461 | high | 8.8 | No | An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the exte... | 2026-09-22 |
| CVE-2023-50460 | medium | 5.4 | No | An issue was discovered in the femanager extension 7.x before 7.2.3 for TYPO3. The backend module allows an authenticated backend user to pe... | 2026-09-22 |