Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16726 | not reported | — | No | Buffer overflow vulnerability in Panasonic Industry USB Driver for MINAS A5/A6 allows attackers to stop Windows. | 2026-09-18 |
| CVE-2026-80462 | critical | 10.0 | No | A vulnerability in the Chef Automate API gateway and identity validation path may allow an unauthenticated actor to gain elevated access to... | 2026-09-18 |
| CVE-2026-87886 | high | 7.8 | Listed | Local privilege escalation due to insecure file permissions. The following products are affected: Acronis Backup plugin for cPanel & WHM (Li... | 2026-09-18 |
| CVE-2026-89207 | medium | 6.5 | No | A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94), WTV776-HB6035 Web Interface (All versions < V4.17... | 2026-09-18 |
| CVE-2026-90823 | critical | 9.8 | No | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain a stack-based buffer overflow in /u... | 2026-09-18 |
| CVE-2026-90822 | critical | 9.8 | No | FatPipe MPVPN, WARP, and IPVPN appliances running the end-of-life firmware version 10.1.2r60p100 contain an OS command injection vulnerabili... | 2026-09-18 |
| CVE-2026-90896 | not reported | — | No | Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts... | 2026-09-18 |
| CVE-2026-80469 | high | 8.3 | No | An attacker may achieve arbitrary code execution on a target system by uploading a malicious device driver package, bypassing driver verific... | 2026-09-18 |
| CVE-2026-28199 | low | 3.3 | No | An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system... | 2026-09-18 |
| CVE-2026-28198 | high | 8.8 | No | An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could bypass the cryptographic signature verif... | 2026-09-18 |
| CVE-2026-28197 | high | 8.8 | No | An authenticated, low-privileged user with access to the NetBackup Flex OS management shell could supply a specially crafted input to a pr... | 2026-09-18 |
| CVE-2026-89307 | not reported | — | No | The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via th... | 2026-09-18 |
| CVE-2026-87793 | not reported | — | No | The "Design Scuole Italia" WordPress theme is affected by a Reflected XSS vulnerability in the filters-scheda-didattica.php file, allowing... | 2026-09-18 |
| CVE-2026-87792 | not reported | — | No | The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv... | 2026-09-18 |
| CVE-2026-87791 | not reported | — | No | A path traversal vulnerability exists in the reserved_file_check function of the functions.php file in the WordPress Design Scuole Italia th... | 2026-09-18 |
| CVE-2026-89308 | not reported | — | No | An unauthenticated OS command injection vulnerability exists in the ping.php endpoint, allowing remote attackers to execute arbitrary comman... | 2026-09-18 |
| CVE-2026-18119 | critical | 9.0 | No | Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, p... | 2026-09-18 |
| CVE-2026-28966 | medium | 4.3 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS... | 2026-09-18 |
| CVE-2026-92976 | not reported | — | No | A stored Cross-Site Scripting (XSS) vulnerability in the profile management functionality of T-Systems’ TAO 2.0 suite. An authenticated user... | 2026-09-18 |
| CVE-2026-14850 | not reported | — | No | The password reset funcionality is vulnerable to unauthorized account modification due to improper validation of the user_id parameter. An a... | 2026-09-18 |