Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93978 | high | 7.3 | No | A vulnerability was identified in code-projects Internship Management System 1.0. Affected by this issue is some unknown functionality of th... | 2026-09-21 |
| CVE-2026-93973 | high | 7.3 | No | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the fil... | 2026-09-21 |
| CVE-2026-93968 | low | 3.8 | No | A vulnerability was determined in aiyiyi121 SxDevOps 1.0/1.1. This affects the function update of the file backend/rbac/serializers.py of th... | 2026-09-21 |
| CVE-2026-93963 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module... | 2026-09-21 |
| CVE-2026-93958 | critical | 9.1 | No | A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component... | 2026-09-21 |
| CVE-2026-93742 | critical | 9.9 | No | A weakness has been identified in Totolink A3002MU Hh-B20211125.1046. Affected by this issue is the function formWsc of the file /boafrm/for... | 2026-09-21 |
| CVE-2026-92729 | high | 8.2 | No | SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthe... | 2026-09-21 |
| CVE-2026-91981 | medium | 4.3 | No | Vikunja versions before 2.6.0 fail to properly validate link-share tokens in the v2 API user search endpoints. Attackers with a read-only sh... | 2026-09-21 |
| CVE-2026-91971 | medium | 6.5 | No | Vikunja before 2.6.0 fails to apply pixel decode limits to avatar and project-background upload endpoints, allowing authenticated users to u... | 2026-09-21 |
| CVE-2026-88259 | high | 7.5 | No | CareCam CM2507 IP cameras do not require authentication for access to its network video streaming service. An unauthenticated attacker with... | 2026-09-21 |
| CVE-2026-85497 | critical | 9.8 | No | CareCam CM2507 IP cameras store the device's root-account password using a fixed legacy password hash that provides insufficient resistance... | 2026-09-21 |
| CVE-2026-85478 | low | 3.5 | No | A CM2507 IP camera running firmware version HMT.CM2507 v251211.1507 exposes an interactive bootloader through a physical debug interface wit... | 2026-09-21 |
| CVE-2026-77972 | not reported | — | No | Time-of-check Time-of-use (TOCTOU) Race Condition in Slab safeurl allows an attacker who controls a hostname's DNS responses to reach intern... | 2026-09-21 |
| CVE-2026-75894 | high | 7.5 | No | In osmo-iuh from 0.1.0 through 1.8.0 a reachable assertion was found in the ranap_handle_co_dt() function via a arbitrarily sized NAS-PDU th... | 2026-09-21 |
| CVE-2026-76861 | high | 8.8 | No | Netcore NR255-V version 1.5.130703 contains a stack-based buffer overflow in ntools_tcpdump_start_set.cgi caused by an unsized sprintf call... | 2026-09-21 |
| CVE-2026-76856 | high | 8.1 | No | Netcore NR255-V firmware version 1.5.130703 contains a cross-site request forgery vulnerability affecting the wan_config_set_cgi, wan_num_se... | 2026-09-21 |
| CVE-2026-77866 | not reported | — | No | Server-Side Request Forgery (SSRF) vulnerability in Slab safeurl allows an attacker who controls a validated URL to reach internal network d... | 2026-09-21 |
| CVE-2026-75893 | high | 7.5 | No | In osmo-bsc from 1.0.1 through 1.14.1 a heap based buffer overflow issue was found in the ipaccess_proxy_read_msg() function via IPA frame l... | 2026-09-21 |
| CVE-2026-75892 | medium | 6.5 | No | In osmo-ggsn 1.14.0 an out of bounds write issue was found in the gtp_decode_pdp_ctx() function through the PDP context GSN-Address sub-fiel... | 2026-09-21 |
| CVE-2026-47321 | high | 7.5 | No | The CompressionFilter class uses ZLib to deflate and inflate data sent and received. When we inflate incoming data, the filter does not cont... | 2026-09-21 |