Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87567 | medium | 4.3 | No | UI misrepresentation in UrlFormatting in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to spo... | 2026-09-09 |
| CVE-2026-87564 | medium | 4.3 | No | Type confusion in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to read memory inside the sandbox via a crafted HTML... | 2026-09-09 |
| CVE-2026-85506 | critical | 9.8 | No | ipmi-oem in FreeIPMI before 1.6.19 has a stack-based buffer overflow in _get_dell_system_info_idrac_info in ipmi-oem/ipmi-oem-dell.c (idrac-... | 2026-09-09 |
| CVE-2026-79617 | high | 7.1 | No | Incorrect Permission Assignment for Critical Resource vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus LightD... | 2026-09-09 |
| CVE-2026-79572 | high | 7.5 | No | An XXE (XML External Entity) vulnerability in the level-rule module of Distribution Management v1.0.0 allows attackers to read sensitive fil... | 2026-09-09 |
| CVE-2026-78738 | medium | 6.1 | No | Silverpeas Core 6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Document management file upload feature. | 2026-09-09 |
| CVE-2026-78838 | medium | 6.5 | No | A reflected cross-site scripting (XSS) vulnerability in the grid_datasource.php component of AppNitro MachForm v30 allows attackers to execu... | 2026-09-09 |
| CVE-2026-78839 | high | 8.1 | No | An arbitrary file upload vulnerability in AppNitro MachForm v30 allows attackers to execute arbitrary code via uploading a crafted .phar fil... | 2026-09-09 |
| CVE-2026-75170 | medium | 6.1 | No | Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote u... | 2026-09-09 |
| CVE-2026-75166 | high | 8.8 | No | Insecure Permission vulnerability in MBS-Solutions X-Serie Gateway firmware V6_00_05 allows the low-privileged service user to execute /usr/... | 2026-09-09 |
| CVE-2026-75162 | medium | 6.5 | No | An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V... | 2026-09-09 |
| CVE-2026-71625 | critical | 9.8 | No | An issue in slimkit plus ThinkSNS+ v.2.4 allows a remote attacker to escalate privileges via the ResetPasswordController.php component | 2026-09-09 |
| CVE-2026-71622 | high | 7.4 | No | SQL injection vulnerability in Zhao-github APiAdmin v.5.0.1 allows a remote attacker to obtain sensitive information via the User.php compon... | 2026-09-09 |
| CVE-2026-68484 | not reported | — | No | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify... | 2026-09-09 |
| CVE-2026-67403 | not reported | — | No | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks... | 2026-09-09 |
| CVE-2026-86199 | high | 7.5 | No | PocketMine-MP versions before 5.43.1 fail to properly validate the Certificate field during offline login authentication. Unauthenticated pl... | 2026-09-09 |
| CVE-2026-86099 | high | 8.2 | No | Chainlit through 2.12.0 fails to validate the client-supplied socket.io sessionId parameter, allowing unauthenticated attackers to traverse... | 2026-09-09 |
| CVE-2026-64857 | not reported | — | No | tirreno, a security framework, has a session fixation issue in versions prior to 0.10.0. During authentication, tirreno validates the user's... | 2026-09-09 |
| CVE-2026-87821 | high | 7.1 | No | Lara Dashboard through 1.3.1 contains a server-side request forgery vulnerability in the POST /api/admin/builder/markdown/fetch endpoint tha... | 2026-09-09 |
| CVE-2026-87813 | high | 7.3 | No | SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in the Search Assets result list where asset filenames are interpo... | 2026-09-09 |