Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92527 | medium | 6.3 | No | A vulnerability has been found in chatwoot up to 4.17.1. This impacts an unknown function of the file callbacks_controller.rb of the compone... | 2026-09-17 |
| CVE-2026-92474 | low | 3.3 | No | A security flaw has been discovered in GPAC 26.08-DEV. This affects the function gf_inline_get_proto_lib of the file src/compositor/mpeg4_in... | 2026-09-17 |
| CVE-2026-92472 | low | 3.3 | No | A vulnerability was determined in GPAC 26.08-DEV. The affected element is the function gf_node_deactivate_ex of the file src/scenegraph/base... | 2026-09-17 |
| CVE-2026-92418 | low | 3.5 | No | A vulnerability was determined in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This vulnerability affects unknown code of... | 2026-09-17 |
| CVE-2026-92986 | high | 8.8 | No | SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set maliciou... | 2026-09-17 |
| CVE-2026-92956 | critical | 10.0 | No | vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssem... | 2026-09-17 |
| CVE-2026-92951 | critical | 9.9 | No | vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring ma... | 2026-09-17 |
| CVE-2026-92946 | critical | 10.0 | No | vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excl... | 2026-09-17 |
| CVE-2026-92940 | critical | 10.0 | No | vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured... | 2026-09-17 |
| CVE-2026-92935 | critical | 9.0 | No | vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireCon... | 2026-09-17 |
| CVE-2026-92087 | high | 8.1 | No | @fastify/auth is a Fastify plugin that composes multiple authentication and authorization strategies into a single route guard. In versions... | 2026-09-17 |
| CVE-2026-91984 | medium | 4.3 | No | Vikunja before 2.6.0 fails to validate that user-supplied project_view_id in task-position requests belongs to the task's project. Authentic... | 2026-09-17 |
| CVE-2026-91979 | medium | 6.5 | No | Vikunja before 2.6.0 fails to limit archive expansion during data import, allowing authenticated users to cause denial of service. Attackers... | 2026-09-17 |
| CVE-2026-91969 | medium | 6.5 | No | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to l... | 2026-09-17 |
| CVE-2026-91944 | medium | 6.1 | No | crawl4ai versions before 0.9.3 contain a DOM-based cross-site scripting vulnerability in the Playground UI where the forceHighlightElement()... | 2026-09-17 |
| CVE-2026-91938 | high | 7.1 | No | Flowise versions before 3.1.4 contain a server-side request forgery vulnerability in Cheerio, Playwright, and Puppeteer document loader node... | 2026-09-17 |
| CVE-2026-91933 | high | 7.1 | No | Flowise before 3.1.4 fails to enforce workspace-level authorization checks in openai-realtime endpoints, allowing authenticated users to acc... | 2026-09-17 |
| CVE-2026-86465 | medium | 6.5 | No | Apache Airflow Akeyless provider: the Akeyless secrets backend's team-scope guard can be bypassed with a user-controlled key. In a multi-tea... | 2026-09-17 |
| CVE-2026-85875 | medium | 5.5 | No | Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally. | 2026-09-17 |
| CVE-2026-81960 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | 2026-09-17 |