Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86752 | medium | 5.4 | No | snipe-it versions before 8.7.0 fail to enforce per-instance FMCS scoping in asset audit endpoints, relying solely on query-layer filtering i... | 2026-09-14 |
| CVE-2026-86753 | medium | 4.3 | No | snipe-it versions before 8.7.0 fail to validate the requestable flag for asset models in the POST /account/request/asset_model/{modelId} end... | 2026-09-14 |
| CVE-2026-86714 | medium | 5.4 | No | PX4 Autopilot through 1.17.0 contains a stack buffer over-read vulnerability in the netman system command that fails to validate interface n... | 2026-09-14 |
| CVE-2026-86543 | critical | 9.8 | No | knowns versions before 0.30.0 serve the management API without authentication on all network interfaces by default, with no password require... | 2026-09-14 |
| CVE-2026-86538 | high | 7.5 | No | knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated... | 2026-09-14 |
| CVE-2026-85625 | high | 8.1 | No | sift (sift.js) 17.1.3 enumerates query keys with for...in, which walks the object prototype chain, and dispatches any matched operator key i... | 2026-09-14 |
| CVE-2026-85612 | high | 7.5 | No | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints tha... | 2026-09-14 |
| CVE-2026-85603 | medium | 6.5 | No | Grav versions before 1.10.55 contain a path traversal vulnerability in the admin plugin's Save As action that fails to validate the language... | 2026-09-14 |
| CVE-2026-85598 | medium | 6.4 | No | Grav versions 2.0.0 through 2.0.17 fail to apply save-time XSS detection to modular pages, allowing authenticated page editors to store Twig... | 2026-09-14 |
| CVE-2026-85583 | medium | 6.5 | No | SiYuan versions before v3.8.2 contain a path traversal vulnerability in the reader-accessible file-read endpoint that follows symlinks when... | 2026-09-14 |
| CVE-2026-85200 | high | 7.5 | No | The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmw_posts_loc... | 2026-09-14 |
| CVE-2026-80115 | medium | 6.1 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privile... | 2026-09-14 |
| CVE-2026-78006 | critical | 9.8 | No | The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.4 via the is_... | 2026-09-14 |
| CVE-2026-77161 | medium | 6.5 | No | The Smart Marketing SMS and Newsletters Forms plugin for WordPress is vulnerable to generic SQL Injection via Parameter Name in all versions... | 2026-09-14 |
| CVE-2026-73318 | low | 3.8 | No | XenForo before 2.3.13 contains a missing authorization vulnerability in the force-agreement controller that allows any ACP administrator to... | 2026-09-14 |
| CVE-2026-73313 | high | 8.1 | No | XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated a... | 2026-09-14 |
| CVE-2026-10148 | medium | 6.4 | No | The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor wi... | 2026-09-14 |
| CVE-2026-84889 | high | 8.8 | No | IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a... | 2026-09-14 |
| CVE-2026-86087 | medium | 4.3 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbi... | 2026-09-14 |
| CVE-2026-86093 | high | 7.5 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an attacker with the ability to control or impersonate a DRDA server en... | 2026-09-14 |