Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88922 | medium | 6.7 | No | The go-getter library up to versions 1.8.8 and 2.2.3 is vulnerable to a privilege escalation issue in its archive decompression handling tha... | 2026-09-20 |
| CVE-2026-87824 | high | 7.5 | No | zstd-jni before 1.5.7-14 fails to validate the samples buffer capacity in Zstd.trainFromBufferDirect, allowing attackers to read past buffer... | 2026-09-20 |
| CVE-2026-86774 | medium | 6.3 | No | Snipe-IT versions before 8.7.0 contain a broken access control vulnerability in AssetModelPolicy where the files() method cascades from asse... | 2026-09-20 |
| CVE-2026-86769 | medium | 4.3 | No | Snipe-IT versions before 8.7.0 contain an improper ownership management vulnerability in the consumables checkout API endpoint that records... | 2026-09-20 |
| CVE-2026-86764 | medium | 6.5 | No | Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware//... | 2026-09-20 |
| CVE-2026-84850 | medium | 4.8 | No | Improper certificate validation in the shared HTTP client used by synchronization and integration features in Devolutions Server 2026.2.16 a... | 2026-09-20 |
| CVE-2026-81898 | not reported | — | No | In Concrete CMS below version 9.5.3, the Address attribute's country-less text formatter skipped HTML-escaping, enabling stored XSS in Expre... | 2026-09-20 |
| CVE-2026-82519 | medium | 4.3 | No | Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-... | 2026-09-20 |
| CVE-2026-86759 | high | 7.1 | No | Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary... | 2026-09-20 |
| CVE-2026-86754 | high | 7.3 | No | Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register... | 2026-09-20 |
| CVE-2026-68532 | not reported | — | No | Concrete CMS 9.0.0 to dashboard group type controller did not validate a CSRF token on its delete action, resulting in cross-site request fo... | 2026-09-20 |
| CVE-2026-65382 | medium | 5.5 | No | A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in macOS Golden Gate 27,... | 2026-09-20 |
| CVE-2026-13327 | high | 8.3 | No | Improper certificate validation on LDAPS connections to Active Directory in Devolutions Server 2026.2.16 and earlier allows a network-positi... | 2026-09-20 |
| CVE-2026-18113 | not reported | — | No | In Concrete CMS 9.0 to 9.5.2, the Top Navigation Bar block did not HTML-escape dropdown child page names before writing them into the page,... | 2026-09-20 |
| CVE-2026-13272 | medium | 5.4 | No | IBM Verify Identity Access is missing origin validation which could allow a remote attacker to perform operations as the victim and potentia... | 2026-09-20 |
| CVE-2026-12101 | high | 8.1 | No | IBM Verify Identity Access could allow an administrator to execute additional commands they are not entitled to due to improper validation o... | 2026-09-20 |
| CVE-2026-11927 | medium | 6.5 | No | IBM Security Verify Identity Access reverse proxy may allow parameters to be injected in requests to third party services. | 2026-09-20 |
| CVE-2026-11918 | medium | 5.4 | No | IBM ContextForge MCP Gateway <= v1.0.4 IBM mcp-context-forge could allow an authenticated user to bypass protection mechanisms due to incomp... | 2026-09-20 |
| CVE-2026-76757 | medium | 5.9 | No | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. | 2026-09-19 |
| CVE-2026-92554 | medium | 6.1 | No | The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripti... | 2026-09-19 |