Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82024 | medium | 5.4 | No | LearnPress WordPress Plugin before 4.4.6 contains a stored cross-site scripting vulnerability that allows authenticated attackers with the I... | 2026-09-08 |
| CVE-2026-82023 | medium | 4.3 | No | LearnPress WordPress Plugin before 4.4.6 contains a broken object-level authorization vulnerability that allows authenticated attackers with... | 2026-09-08 |
| CVE-2026-71963 | high | 8.8 | No | Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute... | 2026-09-08 |
| CVE-2026-85175 | high | 8.8 | No | SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),... | 2026-09-08 |
| CVE-2026-85174 | high | 8.8 | No | SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timi... | 2026-09-08 |
| CVE-2026-85164 | high | 7.1 | No | WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the set_api_userImages API endpoint that fails... | 2026-09-08 |
| CVE-2026-85163 | medium | 6.5 | No | AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the EPG parser that allows authenticated uploaders t... | 2026-09-08 |
| CVE-2026-85162 | medium | 6.5 | No | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in plugin/Live/saveLive.php that lacks forbidIfNotPost a... | 2026-09-08 |
| CVE-2026-85161 | medium | 4.3 | No | AVideo through commit c91b5975d contains a cross-site request forgery vulnerability in removePoster.php that lacks forbidIfNotPost or forbid... | 2026-09-08 |
| CVE-2026-85160 | high | 8.1 | No | AVideo through commit c91b5975d contains a cross-site request forgery and path traversal vulnerability in stopLive.php that allows attackers... | 2026-09-08 |
| CVE-2026-85159 | medium | 5.4 | No | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is ec... | 2026-09-08 |
| CVE-2026-85158 | medium | 5.4 | No | AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter i... | 2026-09-08 |
| CVE-2026-85157 | medium | 5.3 | No | WWBN AVideo contains a broken access control vulnerability in the unauthenticated feed/index.php endpoint that disables per-video visibility... | 2026-09-08 |
| CVE-2026-85156 | medium | 5.3 | No | WWBN AVideo fails to properly validate access controls on the public channel page, allowing unauthenticated visitors to view unlisted and gr... | 2026-09-08 |
| CVE-2026-85155 | high | 7.5 | No | WWBN AVideo contains a SQL injection vulnerability in the sort column parameter of the get.json.php endpoint with APIName=channels that allo... | 2026-09-08 |
| CVE-2026-85154 | critical | 9.8 | No | WWBN AVideo contains an authentication failure vulnerability where the video_id_hash credential is a non-expiring, non-revocable bearer toke... | 2026-09-08 |
| CVE-2026-75137 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover cleartext vault d... | 2026-09-08 |
| CVE-2026-75136 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains an insecure credential storage vulnerability that allows local attackers to retrieve the biometr... | 2026-09-08 |
| CVE-2026-75135 | medium | 6.1 | No | UpSignOn for Windows before 7.19.0 contains a sensitive data exposure vulnerability that allows local attackers to recover the master passwo... | 2026-09-08 |
| CVE-2026-84695 | high | 8.7 | No | BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64... | 2026-09-08 |