Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-90507 | medium | 6.3 | No | A vulnerability was identified in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. Affected is the function get_surge... | 2026-09-14 |
| CVE-2026-90505 | medium | 5.0 | No | A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicen... | 2026-09-14 |
| CVE-2026-90502 | low | 3.5 | No | A vulnerability was detected in stilleshan ServerStatus 1.0/2.0. Impacted is an unknown function of the file server/src/main.cpp of the comp... | 2026-09-14 |
| CVE-2026-90500 | medium | 6.3 | No | A weakness has been identified in lenve vhr 1.0-SNAPSHOT. This vulnerability affects the function FastDFSUtils.upload of the file /hr/userfa... | 2026-09-14 |
| CVE-2026-90497 | low | 3.5 | No | A vulnerability was determined in Fengoffice Feng Office up to 3.11.13.11. Affected by this vulnerability is the function getTitle of the fi... | 2026-09-14 |
| CVE-2026-90495 | high | 7.3 | No | A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance->findAll of the file... | 2026-09-14 |
| CVE-2026-90492 | medium | 6.3 | No | A security vulnerability has been detected in webgjc web_robot 2.4.0/2.5.0/2.8.0. The affected element is the function controller_listen/con... | 2026-09-14 |
| CVE-2026-90490 | medium | 6.3 | No | A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Per... | 2026-09-14 |
| CVE-2026-90487 | medium | 4.3 | No | A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src... | 2026-09-14 |
| CVE-2026-90485 | medium | 5.5 | No | A flaw has been found in IOBit Uninstaller 15.5.0.11. Affected by this issue is the function sub_11838 of the file IURegistryFilter.sys of t... | 2026-09-14 |
| CVE-2026-86740 | low | 3.8 | No | Snipe-IT before 8.7.0 fails to check the return value of Storage::delete() in UploadedFilesController::destroy() and Api\\UploadedFilesContr... | 2026-09-14 |
| CVE-2026-86741 | high | 8.5 | No | Snipe-IT versions before 8.7.0 fail to sanitize the category EULA text field before rendering it in checkout confirmation emails. Attackers... | 2026-09-14 |
| CVE-2026-86742 | medium | 6.5 | No | Snipe-IT through 8.6.3 does not neutralize formula elements in the "unaccepted assets" acceptance report CSV export. ReportsController::post... | 2026-09-14 |
| CVE-2026-86743 | medium | 5.0 | No | Snipe-IT versions before 8.7.0 fail to properly scope asset acceptance report queries by company, allowing authenticated reports.view users... | 2026-09-14 |
| CVE-2026-86745 | medium | 6.5 | No | Snipe-IT is an IT asset management application. In Snipe-IT master-branch builds after 8.6.3 (the code was never included in a tagged releas... | 2026-09-14 |
| CVE-2026-86746 | medium | 6.4 | No | Snipe-IT before 8.7.0 contains an authorization bypass vulnerability in Livewire components that enforce authorization only at the route lev... | 2026-09-14 |
| CVE-2026-86747 | medium | 5.4 | No | Snipe-IT is an open source IT asset management system. In versions up to and including 8.6.3, the report acceptance endpoints POST /reports/... | 2026-09-14 |
| CVE-2026-86748 | medium | 6.1 | No | Snipe-IT versions before 8.7.0 wipe the database before validating the uploaded backup archive in the restore endpoint. Superusers uploading... | 2026-09-14 |
| CVE-2026-86750 | high | 7.7 | No | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not validate company assignment authorization before persisting user records via the REST API... | 2026-09-14 |
| CVE-2026-86751 | critical | 9.6 | No | Snipe-IT before 8.7.0 fails to properly sanitize markdown image syntax in note fields, allowing authenticated users to read arbitrary server... | 2026-09-14 |