Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86689 | medium | 5.9 | No | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs... | 2026-09-18 |
| CVE-2026-86520 | high | 7.5 | No | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs... | 2026-09-18 |
| CVE-2026-77960 | medium | 5.3 | No | Bransys ELD is shipped with hardcoded MQTT credentials, which will grant read access to real-time data for every active device across a subs... | 2026-09-18 |
| CVE-2026-81911 | medium | 5.4 | No | Concrete CMS versions 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Board Custom Slot dialog. The custom_slot save_template endpoint authori... | 2026-09-18 |
| CVE-2026-69513 | high | 7.8 | No | Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally. | 2026-09-18 |
| CVE-2026-86426 | critical | 9.8 | No | LibreNMS before 26.8.0 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to access prote... | 2026-09-18 |
| CVE-2026-86427 | high | 8.8 | No | LibreNMS before 26.8.0 contains an argument injection vulnerability in the graph_title parameter that allows authenticated attackers to inje... | 2026-09-18 |
| CVE-2026-93606 | critical | 10.0 | No | vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host... | 2026-09-18 |
| CVE-2026-93597 | high | 7.7 | No | ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Au... | 2026-09-18 |
| CVE-2026-93596 | medium | 4.3 | No | ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction... | 2026-09-18 |
| CVE-2026-93019 | critical | 9.1 | No | Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read. The rea... | 2026-09-18 |
| CVE-2026-92468 | medium | 6.5 | No | zlt2000 microservices-platform through 6.0.0 contains an authorization bypass vulnerability in the search-center service that allows authent... | 2026-09-18 |
| CVE-2026-92399 | high | 7.3 | No | A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the c... | 2026-09-18 |
| CVE-2026-92381 | low | 3.5 | No | A weakness has been identified in PbootCMS up to 3.2.22. This affects the function decode_string of the file apps/admin/controller/content/C... | 2026-09-18 |
| CVE-2026-92363 | medium | 4.3 | No | A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JS... | 2026-09-18 |
| CVE-2026-90489 | low | 3.5 | No | A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such man... | 2026-09-18 |
| CVE-2026-1037 | medium | 6.1 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T... | 2026-09-18 |
| CVE-2026-1029 | medium | 5.4 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T... | 2026-09-18 |
| CVE-2026-10030 | high | 7.1 | No | IBM MQ Console allows authenticated non-administrative users to create and start queue managers due to improper authorization checks. | 2026-09-18 |
| CVE-2026-8674 | medium | 5.3 | No | Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain... | 2026-09-18 |