Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16777 | medium | 4.9 | No | The Store Exporter – Export WooCommerce Products, Orders, Subscriptions, Customers plugin for WordPress is vulnerable to Directory Traversal... | 2026-09-18 |
| CVE-2026-13684 | critical | 9.8 | No | An improper encoding or escaping of output vulnerability in SCGI in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9,... | 2026-09-18 |
| CVE-2026-13673 | high | 8.8 | No | An incorrect permission assignment for critical resource vulnerability in LDAP API in Synology DiskStation Manager (DSM) before 7.2.1-69057-... | 2026-09-18 |
| CVE-2026-13666 | low | 3.5 | No | An improper neutralization of CRLF sequences ('CRLF Injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.... | 2026-09-18 |
| CVE-2026-13639 | critical | 9.8 | No | An insufficient entropy vulnerability in login logic in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-72806-9, 7.3.2-86009... | 2026-09-18 |
| CVE-2026-13635 | medium | 5.3 | No | An improper encoding or escaping of output vulnerability in Auth API in Synology DiskStation Manager (DSM) before 7.2.1-69057-12, 7.2.2-7280... | 2026-09-18 |
| CVE-2026-13471 | medium | 4.3 | No | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference i... | 2026-09-18 |
| CVE-2026-13285 | high | 7.1 | No | IBM MQ is vulnerable to an XML external entity injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnera... | 2026-09-18 |
| CVE-2026-12384 | high | 8.8 | No | Authorization bypass through User-Controlled key vulnerability in TECHIN2B TECHIN2B Application allows Privilege Abuse. This issue affects... | 2026-09-18 |
| CVE-2026-11757 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in KA Informatics Technologies Ltd. Co. B... | 2026-09-18 |
| CVE-2026-56988 | medium | 6.4 | No | In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation o... | 2026-09-18 |
| CVE-2026-56986 | high | 8.4 | No | In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to local escalation of privilege with no ad... | 2026-09-18 |
| CVE-2026-56970 | high | 8.4 | No | In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privi... | 2026-09-18 |
| CVE-2026-56972 | medium | 6.7 | No | In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of priv... | 2026-09-18 |
| CVE-2026-56973 | medium | 6.7 | No | In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of... | 2026-09-18 |
| CVE-2026-56974 | high | 8.8 | No | In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to rem... | 2026-09-18 |
| CVE-2026-56975 | medium | 6.5 | No | In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (proximal/adjacent) den... | 2026-09-18 |
| CVE-2026-56978 | high | 8.4 | No | In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escal... | 2026-09-18 |
| CVE-2026-56979 | medium | 6.7 | No | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil... | 2026-09-18 |
| CVE-2026-56982 | high | 7.8 | No | In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with Syste... | 2026-09-18 |