Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-63464 | high | 7.7 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role... | 2026-09-08 |
| CVE-2026-61699 | high | 8.1 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.7.1, revocation is the only in-band mechanism that... | 2026-09-08 |
| CVE-2026-55513 | medium | 5.4 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.3.0 to before version 0.5.0, the nebula-mgmt Web UI hos... | 2026-09-08 |
| CVE-2026-53604 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, the web handler renderMobileBundle passes the... | 2026-09-08 |
| CVE-2026-53603 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.8, Operator session tokens are stored in plaintex... | 2026-09-08 |
| CVE-2026-53602 | not reported | — | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that... | 2026-09-08 |
| CVE-2026-73848 | not reported | — | No | Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the... | 2026-09-08 |
| CVE-2026-53757 | not reported | — | No | Emlog is an open source website building system. In versions 2.6.29 and prior, the emUnZip() function extracts all ZIP entries via ZipArchiv... | 2026-09-08 |
| CVE-2026-53756 | medium | 4.9 | No | Emlog is an open source website building system. Prior to version 2.6.16, Emlog CMS Pro contains a blind SQL injection in User_Model::getUse... | 2026-09-08 |
| CVE-2026-78522 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-09-08 |
| CVE-2026-80079 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-09-08 |
| CVE-2026-83949 | medium | 5.5 | No | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 2026-09-08 |
| CVE-2026-83951 | medium | 5.5 | No | Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | 2026-09-08 |
| CVE-2026-77911 | medium | 6.5 | No | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network. | 2026-09-08 |
| CVE-2026-85614 | high | 8.6 | No | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that ac... | 2026-09-08 |
| CVE-2026-85613 | high | 8.2 | No | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that al... | 2026-09-08 |
| CVE-2026-85611 | medium | 6.4 | No | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayo... | 2026-09-08 |
| CVE-2026-85609 | high | 7.5 | No | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker... | 2026-09-08 |
| CVE-2026-85388 | high | 8.1 | No | Worklenz through 3.0.0 fails to properly validate the sort-field query parameter in pagination helper functions, allowing authenticated user... | 2026-09-08 |
| CVE-2026-82526 | critical | 9.8 | No | R2R through 3.6.6 contains a stacked SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL statements b... | 2026-09-08 |