Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93955 | medium | 4.3 | No | A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToRespon... | 2026-09-21 |
| CVE-2026-93981 | medium | 4.7 | No | hono before 4.13.7 fails to HTML-escape plain strings rendered by hono/jsx as a child or fallback of Suspense, as a string child of ErrorBou... | 2026-09-21 |
| CVE-2026-93685 | medium | 5.4 | No | A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a mis... | 2026-09-21 |
| CVE-2026-93605 | critical | 10.0 | No | vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite b... | 2026-09-21 |
| CVE-2026-93595 | medium | 6.5 | No | ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The... | 2026-09-21 |
| CVE-2026-93013 | medium | 4.3 | No | RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoint... | 2026-09-21 |
| CVE-2026-92961 | high | 7.5 | No | vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to al... | 2026-09-21 |
| CVE-2026-92927 | medium | 5.3 | No | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /db/drug_... | 2026-09-21 |
| CVE-2026-92959 | high | 7.1 | No | vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a... | 2026-09-21 |
| CVE-2026-81181 | low | 3.7 | No | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.68, the password authentication flow for protected shared notes... | 2026-09-21 |
| CVE-2026-84450 | medium | 4.3 | No | libheif is a HEIF and AVIF file format decoder and encoder. From 1.19.0 until 1.23.3, a crafted image item containing a clap property and an... | 2026-09-21 |
| CVE-2026-84446 | high | 7.5 | No | libheif is a HEIF and AVIF file format decoder and encoder. Prior to 1.23.2, crafted HEIF sequence timing and edit-list data can make Track:... | 2026-09-21 |
| CVE-2026-63459 | high | 8.7 | No | Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/share... | 2026-09-21 |
| CVE-2026-54586 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mport_fetch_index(), mport_fetch_bootstrap_index(), and mport_fetch_bundle() p... | 2026-09-21 |
| CVE-2026-54575 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handli... | 2026-09-21 |
| CVE-2024-40766 | critical | 9.8 | Listed | An improper access control vulnerability has been identified in the SonicWall SonicOS management access, potentially leading to unauthorized... | 2026-09-21 |
| CVE-2026-94210 | low | 3.5 | No | A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tic... | 2026-09-21 |
| CVE-2026-94148 | medium | 5.3 | No | A vulnerability was determined in ScadaBR up to 1.1. Impacted is the function EmportDwr.createExportJSON of the file /ScadaBR/export_project... | 2026-09-21 |
| CVE-2026-94142 | high | 8.8 | No | A security vulnerability has been detected in BioStar Temperature Monitor Utility 1.2.1806.2200. Affected by this vulnerability is the funct... | 2026-09-21 |
| CVE-2026-94128 | high | 8.8 | No | A security vulnerability has been detected in BioStar VIVID LED DJ 4.0.2411.1500. This affects the function sub_1105C of the file BS_LED64.s... | 2026-09-21 |