Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62104 | critical | 10.0 | No | Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions. | 2026-09-19 |
| CVE-2026-27553 | medium | 6.5 | No | A low-privileged remote attacker can manipulate the schema path parameter in the /index.php/diagnostics_tab/ajax_diag_table_rows endpoint us... | 2026-09-19 |
| CVE-2026-75513 | critical | 9.1 | No | Marten is a .NET Transactional Document DB and Event Store on PostgreSQL. From version 7.0.0 until 9.13.0, several Marten LINQ and tenant-ma... | 2026-09-19 |
| CVE-2026-93650 | low | 3.7 | No | A vulnerability was determined in Saleor up to 3.20.118/3.21.54/3.22.47/3.23.14. This vulnerability affects the function get_client_ip of th... | 2026-09-18 |
| CVE-2026-93591 | high | 7.6 | No | SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated ra... | 2026-09-18 |
| CVE-2026-93331 | high | 7.3 | No | A vulnerability was identified in GPAC 26.08-DEV. This vulnerability affects the function gf_rtp_parse_ttxt of the file src/ietf/rtp_depacke... | 2026-09-18 |
| CVE-2026-93310 | medium | 5.3 | No | A vulnerability was identified in O-RAN-SC SMO OAM 2025-06-10. This affects an unknown part of the component VES Collector. The manipulation... | 2026-09-18 |
| CVE-2026-92963 | medium | 5.3 | No | vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attac... | 2026-09-18 |
| CVE-2026-92958 | high | 8.5 | No | vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative e... | 2026-09-18 |
| CVE-2026-92953 | critical | 10.0 | No | vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use p... | 2026-09-18 |
| CVE-2026-92948 | critical | 9.9 | No | vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer... | 2026-09-18 |
| CVE-2026-92942 | high | 7.5 | No | vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run(... | 2026-09-18 |
| CVE-2026-92937 | critical | 10.0 | No | vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v i... | 2026-09-18 |
| CVE-2026-92622 | medium | 6.4 | No | The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute in all ve... | 2026-09-18 |
| CVE-2026-85652 | medium | 6.5 | No | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Sho... | 2026-09-18 |
| CVE-2026-82985 | medium | 6.5 | No | The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewi... | 2026-09-18 |
| CVE-2026-82982 | medium | 4.3 | No | The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from app... | 2026-09-18 |
| CVE-2026-82980 | medium | 6.3 | No | Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves f... | 2026-09-18 |
| CVE-2026-81179 | high | 8.1 | No | SysReptor is a fully customizable pentest reporting platform. Prior to 2026.58, installations that enable password reset by email while conf... | 2026-09-18 |
| CVE-2026-79954 | not reported | — | No | NASA CryptoLib 1.5.0 contains an authentication downgrade vulnerability in the Telecommand (TC) receive path. The receiver selects the Secur... | 2026-09-18 |