Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-36989 | medium | 5.8 | No | A SQL Injection vulnerability exists in LuxSoft LuxCal through 5.3.4L via rssfeed.php and common/retrieve.php. | 2026-09-22 |
| CVE-2026-36453 | high | 7.4 | No | Rhymix before 2.1.31 allows insecure direct object reference, aka RVE-2026-1. Arbitrary files can be accessed via extra variables. | 2026-09-22 |
| CVE-2026-90679 | medium | 4.3 | No | Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not... | 2026-09-22 |
| CVE-2026-90668 | high | 7.5 | No | The webserver in UnrealIRCd 6.0.5 through 6.2.6 before 6.2.7 does not limit the number of HTTP request headers, which allows remote attacker... | 2026-09-22 |
| CVE-2026-90651 | high | 8.1 | No | Socket Firewall (socketdev/socket-registry-firewall) in registry mode before 2.0.0 does not verify upstream TLS certificates by default. Whe... | 2026-09-22 |
| CVE-2026-90647 | high | 7.4 | No | ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in th... | 2026-09-22 |
| CVE-2026-79300 | low | 3.5 | No | SEP sesam before 5.2.0.24 mishandles User Authorization with MFA. If AD authentication is configured and MFA is enforced, an attacker can cr... | 2026-09-22 |
| CVE-2026-79035 | medium | 6.1 | No | A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to... | 2026-09-22 |
| CVE-2026-52630 | critical | 9.8 | No | SQL Injection vulnerability in Woltlab WCF v.6.2.4 and before allows a remote attacker to updateUserOptions in UserEditor.class.php and the... | 2026-09-22 |
| CVE-2026-79396 | critical | 9.8 | No | Use of hardcoded default credentials in Xiongmai IP Camera XM530 firmware HMT.CM2005-v220608.1837 and earlier stores static account credenti... | 2026-09-22 |
| CVE-2026-79395 | critical | 9.8 | No | An improper authentication vulnerability in the WS-Security (wsse:UsernameToken) verification routine within the Sofia IPC daemon in Xiongma... | 2026-09-22 |
| CVE-2026-79394 | high | 7.5 | No | An insecure default configuration in the embedded Happytime RTSP server within the Sofia IPC daemon in Xiongmai IP Camera XM530 firmware HMT... | 2026-09-22 |
| CVE-2026-79393 | high | 7.5 | No | A heap-based buffer overflow vulnerability in the WS-Addressing Action transformation function in the Sofia IPC daemon in Xiongmai IP Camera... | 2026-09-22 |
| CVE-2026-79362 | high | 8.8 | No | Certain Woltlab products are affected by RCE via Cache Poisoning. WCF >= 6.1.0 until < 6.1.23 and WCF >= 6.2.0 until < 6.2.6. An authenticat... | 2026-09-22 |
| CVE-2026-71646 | high | 7.5 | No | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial... | 2026-09-22 |
| CVE-2026-71644 | critical | 9.8 | No | An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause unsafe tr... | 2026-09-22 |
| CVE-2026-71641 | high | 7.5 | No | An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows an attacker to cause a den... | 2026-09-22 |
| CVE-2026-89169 | not reported | — | No | live-boot ff8867c allows attackers to bypass the dm-verity-enforce-roothash-signature protection mechanism when the .verity file is missing. | 2026-09-22 |
| CVE-2026-89151 | low | 3.5 | No | Forgejo before 16.0.4 allows use of restricted API tokens for unintended access to the "allow maintainer edit" feature. | 2026-09-22 |
| CVE-2026-79590 | medium | 6.5 | No | A NULL pointer dereference vulnerability exists in the Prism parser component of mruby 4.0.0. An attacker can provide a specially crafted Ru... | 2026-09-22 |