Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76855 | medium | 6.5 | No | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the audit endpoints handled by l7_web_auth_l... | 2026-09-16 |
| CVE-2026-73460 | medium | 6.1 | No | On affected platforms running Arista EOS with IS-IS graceful restart enabled, an unauthenticated attacker who can inject a malformed IS-IS L... | 2026-09-16 |
| CVE-2026-73459 | high | 7.4 | No | On affected platforms running Arista EOS with IS-IS configured, an unauthenticated attacker who can inject a specially crafted IS-IS LSP PDU... | 2026-09-16 |
| CVE-2026-73446 | high | 7.4 | No | On affected platforms running Arista EOS with IS-IS configured on a broadcast interface, an unauthenticated attacker can send a crafted IS-I... | 2026-09-16 |
| CVE-2023-27172 | critical | 9.1 | No | Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. This allows attackers to easily obtain the secret key used to s... | 2026-09-16 |
| CVE-2023-27168 | critical | 9.8 | No | An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp fi... | 2026-09-16 |
| CVE-2026-91943 | high | 7.7 | No | Crawl4AI before 0.9.3 contains a server-side request forgery vulnerability in PDFContentScrapingStrategy where _get_pdf_path() re-downloads... | 2026-09-16 |
| CVE-2026-91934 | high | 8.8 | No | Flowise versions before 3.1.4 fail to validate file paths in the SQL Database Chain node when connecting to SQLite databases, allowing authe... | 2026-09-16 |
| CVE-2026-91932 | high | 8.5 | No | Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code exe... | 2026-09-16 |
| CVE-2026-91983 | medium | 4.3 | No | Vikunja before 2.6.0 contains an API token scope bypass vulnerability in task read endpoints where authorization fails to inspect query stri... | 2026-09-16 |
| CVE-2026-91973 | high | 7.5 | No | Vikunja before 2.6.0 contains an authentication bypass vulnerability in CalDAV BasicAuth endpoints that lack rate limiting protection. Remot... | 2026-09-16 |
| CVE-2026-91968 | medium | 6.5 | No | vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expr... | 2026-09-16 |
| CVE-2026-91940 | high | 7.5 | No | crawl4ai before 0.9.3 contains an arbitrary file write vulnerability in PDFContentScrapingStrategy where the _filter_untrusted_fields functi... | 2026-09-16 |
| CVE-2026-91985 | high | 7.5 | No | Vikunja before 2.6.0 fails to properly restrict access to the link-share hash field in single-share read endpoints, allowing read-only membe... | 2026-09-16 |
| CVE-2026-91980 | medium | 4.3 | No | vikunja before 2.6.0 fails to validate team access when attaching teams to projects, allowing authenticated users to enumerate all teams and... | 2026-09-16 |
| CVE-2026-91970 | medium | 6.5 | No | Vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the Planka migrator that fails to enforce aggregate memory budg... | 2026-09-16 |
| CVE-2026-91965 | high | 7.5 | No | WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoi... | 2026-09-16 |
| CVE-2026-81165 | medium | 5.3 | No | Incorrect Authorization vulnerability in Drupal Blazy allows Forceful Browsing. This issue affects Blazy versions: from 0.0.0 to 3.0.18. | 2026-09-16 |
| CVE-2026-92466 | high | 8.8 | No | zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable... | 2026-09-16 |
| CVE-2026-89022 | high | 7.4 | No | BookStack before 26.05.5 contains an authentication bypass vulnerability in its social login implementation that allows unauthenticated atta... | 2026-09-16 |