Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90550 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to check user authorization in the PlayerSkins mediaSession.json.p... | 2026-09-14 |
| CVE-2026-90549 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to properly authorize access to the videosAndroid.json.php endpoin... | 2026-09-14 |
| CVE-2026-90548 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the ImageGallery list.json.php end... | 2026-09-14 |
| CVE-2026-90545 | medium | 4.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php... | 2026-09-14 |
| CVE-2026-90544 | medium | 4.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json... | 2026-09-14 |
| CVE-2026-90543 | medium | 5.3 | No | WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier, with the Live plugin enabled, contains a missing authentication... | 2026-09-14 |
| CVE-2026-90540 | medium | 4.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php end... | 2026-09-14 |
| CVE-2026-90539 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authentication vulnerability in the plugin/TopMenu/me... | 2026-09-14 |
| CVE-2026-90538 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in playlistsFromUser.json... | 2026-09-14 |
| CVE-2026-75134 | medium | 6.4 | No | SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors t... | 2026-09-14 |
| CVE-2026-82438 | high | 8.1 | No | Description Three separate mechanisms allowed a web page on an unrelated origin to read responses that Storm's HTTP components served to an... | 2026-09-14 |
| CVE-2026-82437 | medium | 4.3 | No | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those se... | 2026-09-14 |
| CVE-2026-82435 | critical | 9.8 | No | Description The worker's Netty message decoder is installed ahead of the SASL authentication handlers in the pipeline and acts on frames be... | 2026-09-14 |
| CVE-2026-82434 | medium | 6.5 | No | Description When ZooKeeper authentication is configured, Storm deliberately retains `storm.zookeeper.topology.auth.payload` in the topology... | 2026-09-14 |
| CVE-2026-82433 | medium | 6.5 | No | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where... | 2026-09-14 |
| CVE-2026-82432 | high | 8.1 | No | Description Nimbus validated `topology.blobstore.map` against the calling subject at submission time only. The rebalance operation accepts... | 2026-09-14 |
| CVE-2026-82431 | critical | 9.8 | No | Description `SimpleACLAuthorizer` evaluated the user-level command set by returning early when `nimbus.users` was empty, before `nimbus.gro... | 2026-09-14 |
| CVE-2026-82430 | high | 7.8 | No | Description When launching a Docker or OCI worker, the setuid-root `worker-launcher` first changes ownership of the entire worker directory... | 2026-09-14 |
| CVE-2026-82429 | high | 7.8 | No | Description The setuid-root `worker-launcher` binary adjusts ownership and permissions of worker directories by walking the tree with FTS a... | 2026-09-14 |
| CVE-2026-82428 | high | 8.8 | No | Description Dependency artifacts uploaded with `storm jar --artifacts` were stored under a blob key derived only from the Maven coordinate,... | 2026-09-14 |