Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89255 | high | 8.7 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plug... | 2026-09-11 |
| CVE-2026-89253 | high | 8.7 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donati... | 2026-09-11 |
| CVE-2026-89250 | high | 7.5 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an unauthenticated file read vulnerability in the getRecordedFi... | 2026-09-11 |
| CVE-2026-89248 | medium | 5.3 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 is missing an authentication/authorization check in plugin/WebRTC/status.json... | 2026-09-11 |
| CVE-2026-89245 | medium | 6.5 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in playlistRemove.ph... | 2026-09-11 |
| CVE-2026-89243 | high | 8.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in UserGroups::setG... | 2026-09-11 |
| CVE-2026-89240 | medium | 6.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in plugin/Live/c... | 2026-09-11 |
| CVE-2026-89148 | medium | 5.4 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains an open redirect in objects/playlistSort.php. Because the endpoint i... | 2026-09-11 |
| CVE-2026-84941 | not reported | — | No | An information disclosure vulnerability in the SAML Single Sign-On (SSO) functionality of Omada Controller allows an authenticated user with... | 2026-09-11 |
| CVE-2026-76653 | not reported | — | No | A missing authentication vulnerability in the VPN configuration management has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6400 v... | 2026-09-11 |
| CVE-2026-76652 | not reported | — | No | An authenticated directory traversal vulnerability in file upload functionality has been identified in Archer MR600 (v2, v3 & v5) and TL-MR6... | 2026-09-11 |
| CVE-2026-81906 | not reported | — | No | Concrete CMS OAuth callback login path prior to version 9.5.3 did not check whether an account was active or email-validated before establis... | 2026-09-11 |
| CVE-2026-81754 | high | 7.2 | No | The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scr... | 2026-09-11 |
| CVE-2026-81905 | not reported | — | No | Concrete CMS below 9.5.3 stores user validation hashes for multiple purposes (email/registration validation, password reset, and persistent... | 2026-09-11 |
| CVE-2026-81824 | medium | 4.7 | No | The vulnerability, if exploited, could allow a miscreant to run arbitrary JavaScript code in a browser session of a PIMBoards user who was s... | 2026-09-11 |
| CVE-2026-81822 | high | 8.4 | No | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to reverse engineer PIMBoards users’ ap... | 2026-09-11 |
| CVE-2026-81821 | high | 8.4 | No | The vulnerability, if exploited, could allow a miscreant with read access to PIMBoards project files to decrypt and view sensitive informati... | 2026-09-11 |
| CVE-2026-75777 | high | 8.8 | No | IBM Aspera Enterprise WebApps 1.0.0 through 1.0.5 could allow a local attacker to escape container protections due to unrestricted system ca... | 2026-09-11 |
| CVE-2026-75940 | critical | 9.1 | No | A vulnerability was reported in Lenovo Health Android Application, distributed exclusively in the Chinese market, that could allow an attack... | 2026-09-11 |
| CVE-2026-19486 | not reported | — | No | A Server-Side Request Forgery (SSRF) vulnerability in Google Cloud Gemini Enterprise Agent Platform App Builder versions prior to 2026-06-01... | 2026-09-11 |