Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86544 | high | 8.1 | No | knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-o... | 2026-09-09 |
| CVE-2026-86539 | high | 7.2 | No | knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo... | 2026-09-09 |
| CVE-2026-86436 | medium | 5.4 | No | Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts... | 2026-09-09 |
| CVE-2026-86319 | medium | 5.3 | No | A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of t... | 2026-09-09 |
| CVE-2026-86308 | medium | 5.3 | No | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue... | 2026-09-09 |
| CVE-2026-86302 | medium | 5.3 | No | A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of th... | 2026-09-09 |
| CVE-2026-86297 | high | 8.1 | No | A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.a... | 2026-09-09 |
| CVE-2026-86292 | high | 7.3 | No | A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php o... | 2026-09-09 |
| CVE-2026-86285 | medium | 4.3 | No | A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the f... | 2026-09-09 |
| CVE-2026-86279 | medium | 6.3 | No | A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an u... | 2026-09-09 |
| CVE-2026-86276 | high | 7.3 | No | A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown proce... | 2026-09-09 |
| CVE-2026-86271 | medium | 4.7 | No | A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permi... | 2026-09-09 |
| CVE-2026-86234 | medium | 6.3 | No | A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/cust_transac.ph... | 2026-09-09 |
| CVE-2026-86227 | low | 3.1 | No | A weakness has been identified in valkey-io valkey up to 9.0.5/9.1.1. This affects the function kvstoreGetHashtable of the file src/kvstore.... | 2026-09-09 |
| CVE-2026-86222 | high | 7.3 | No | A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. This affects the function mysqli_query of the file /... | 2026-09-09 |
| CVE-2026-86215 | medium | 4.3 | No | A vulnerability was identified in Mstfakts College-Management-System. The affected element is an unknown function of the file Front-end/serv... | 2026-09-09 |
| CVE-2026-6431 | high | 7.2 | No | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored... | 2026-09-09 |
| CVE-2026-17622 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation... | 2026-09-09 |
| CVE-2026-17627 | high | 7.1 | No | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information and inject messages into w... | 2026-09-09 |
| CVE-2026-17631 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side reque... | 2026-09-09 |