Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92772 | high | 7.1 | No | Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. A... | 2026-09-17 |
| CVE-2026-91942 | medium | 5.4 | No | crawl4ai before 0.9.3 contains a DOM-based cross-site scripting vulnerability in the Docker Playground UI that assigns untrusted crawl resul... | 2026-09-17 |
| CVE-2026-91936 | medium | 6.8 | No | Flowise versions before 3.1.4 contain a script injection vulnerability in Docker image build workflows where workflow_dispatch inputs are di... | 2026-09-17 |
| CVE-2026-91926 | low | 3.7 | No | A flaw was found in gss-ntlmssp. A memory leak occurs in the NTLM target-info parser when a crafted NTLM CHALLENGE message contains duplicat... | 2026-09-17 |
| CVE-2026-84580 | high | 8.4 | No | The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may... | 2026-09-17 |
| CVE-2026-84556 | medium | 5.5 | No | An authorization issue was addressed with improved access control. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... | 2026-09-17 |
| CVE-2026-84522 | medium | 5.9 | No | A race condition was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sen... | 2026-09-17 |
| CVE-2026-57147 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. Prior to 0.1.6, praisonai_platform/services/auth_service.py assigns the public dev-secret-change-me... | 2026-09-17 |
| CVE-2026-57139 | critical | 9.8 | No | PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a... | 2026-09-17 |
| CVE-2026-43791 | medium | 6.5 | No | A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Ta... | 2026-09-17 |
| CVE-2026-14805 | high | 8.8 | No | The Consulting theme for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 6.7.16. This is due to a combinat... | 2026-09-17 |
| CVE-2026-12728 | high | 8.8 | No | IBM MQ 9.1.0.0 through 9.1.0.37 LTS, 9.2.0.0 through 9.2.0.43 LTS, 9.3.0.0 through 9.3.0.41 LTS, 9.3.0.0 through 9.3.5.1 CD, 9.4.0.0 through... | 2026-09-17 |
| CVE-2023-54397 | high | 7.5 | No | Tornado before 6.3.3 contains an HTTP request smuggling vulnerability due to improper parsing of Content-Length headers accepting non-standa... | 2026-09-17 |
| CVE-2026-69507 | medium | 5.7 | No | Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized a... | 2026-09-17 |
| CVE-2026-69267 | medium | 6.5 | No | Insufficient granularity of access control in Windows Connected User Experiences and Telemetry allows an authorized attacker to disclose inf... | 2026-09-17 |
| CVE-2026-20683 | high | 7.1 | No | An authentication issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, mac... | 2026-09-17 |
| CVE-2026-84559 | medium | 5.5 | No | A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.... | 2026-09-17 |
| CVE-2026-92576 | high | 8.6 | No | HKUDS nanobot before 0.3.0 contains a server-side request forgery vulnerability in the WebFetchTool component where the _validate_url() func... | 2026-09-17 |
| CVE-2026-91782 | low | 3.3 | No | A vulnerability was detected in GNU Binutils 2.47. Affected by this vulnerability is the function elf_x86_allocate_dynrelocs of the file bfd... | 2026-09-17 |
| CVE-2026-91090 | low | 3.9 | No | A vulnerability was determined in GPAC up to f1219cde. The affected element is the function gf_node_activate_ex of the file scenegraph/base_... | 2026-09-17 |