Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94401 | not reported | — | No | MISP has a file-handling vulnerability that could let certain authenticated users make the server read files or access internal network serv... | 2026-09-21 |
| CVE-2026-94394 | not reported | — | No | When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does n... | 2026-09-21 |
| CVE-2026-94383 | not reported | — | No | The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only san... | 2026-09-21 |
| CVE-2026-94381 | not reported | — | No | MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let... | 2026-09-21 |
| CVE-2026-94211 | low | 2.4 | No | A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/D... | 2026-09-21 |
| CVE-2026-93374 | critical | 9.6 | No | Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code... | 2026-09-21 |
| CVE-2026-94044 | high | 7.3 | No | A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function crea... | 2026-09-21 |
| CVE-2026-94039 | high | 7.3 | No | A vulnerability was detected in vas3k TaxHacker up to 0.8.5. Affected is the function generateInvoicePDF of the file /apps/invoices/actions.... | 2026-09-21 |
| CVE-2026-94034 | low | 3.5 | No | A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_rec... | 2026-09-21 |
| CVE-2026-94028 | medium | 4.3 | No | A weakness has been identified in mealie-recipes Mealie up to 3.25.1. Affected is the function payload.model_dump of the file mealie/routes/... | 2026-09-21 |
| CVE-2026-93997 | high | 7.3 | No | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the... | 2026-09-21 |
| CVE-2026-93976 | low | 2.4 | No | A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The ma... | 2026-09-21 |
| CVE-2026-93971 | medium | 5.3 | No | A weakness has been identified in aiyiyi121 SxDevOps 1.0/1.1. Impacted is an unknown function of the file backend/sxdevops/settings.py. This... | 2026-09-21 |
| CVE-2026-93966 | medium | 4.7 | No | A vulnerability has been found in aiyiyi121 SxDevOps 1.0/1.1. Affected by this vulnerability is the function paramiko.SSHClient.exec_command... | 2026-09-21 |
| CVE-2026-93961 | medium | 5.3 | No | A security flaw has been discovered in Dromara UJCMS up to 12.3.1. The affected element is the function usernameExist of the file ujcms-cms/... | 2026-09-21 |
| CVE-2026-93956 | low | 3.5 | No | A flaw has been found in olivier-ls PHP-FTS up to 1.1.2. Affected by this issue is the function SearchEngine::buildHighlights of the file sr... | 2026-09-21 |
| CVE-2026-93921 | medium | 4.3 | No | SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to acc... | 2026-09-21 |
| CVE-2026-86802 | low | 3.7 | No | The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate t... | 2026-09-21 |
| CVE-2026-85113 | medium | 6.5 | No | The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pa... | 2026-09-21 |
| CVE-2026-85010 | medium | 5.3 | No | The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added... | 2026-09-21 |