Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84477 | medium | 5.4 | No | AVideo Live_schedule::setTitle() and setDescription() store POST input without sanitization, allowing users with streaming permission to inj... | 2026-09-08 |
| CVE-2026-84476 | high | 7.5 | No | WWBN AVideo fails to validate trusted proxies before accepting X-Real-IP and X-Forwarded-For headers, allowing attackers to spoof the client... | 2026-09-08 |
| CVE-2026-84208 | high | 7.5 | No | AVideo through version 29.0 contains an unauthenticated SQL injection vulnerability in the User_Location plugin's regions.json.php and citie... | 2026-09-08 |
| CVE-2023-54391 | critical | 9.8 | No | Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass vulnerability in libpve-access-control before 8.0.4 that... | 2026-09-08 |
| CVE-2026-73524 | medium | 6.1 | No | Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary s... | 2026-09-08 |
| CVE-2026-71981 | high | 8.8 | No | Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system... | 2026-09-08 |
| CVE-2026-45221 | high | 7.8 | No | Konga before 2.1.0 contains a privilege escalation vulnerability that allows low-privileged local attackers to execute arbitrary code by pla... | 2026-09-08 |
| CVE-2026-8712 | high | 8.3 | No | Wyoming before 1.10.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers with network access to forc... | 2026-09-08 |
| CVE-2026-84207 | medium | 5.4 | No | Heym before 0.0.98 fails to apply SSRF egress guards to WebSocket Send and WebSocket Trigger nodes, allowing authenticated users to connect... | 2026-09-08 |
| CVE-2026-84205 | medium | 6.5 | No | GROWI contains an access control vulnerability in the GET /_api/v3/revisions/:id endpoint that validates access against a query parameter bu... | 2026-09-08 |
| CVE-2026-84204 | medium | 6.5 | No | GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. A... | 2026-09-08 |
| CVE-2026-84203 | high | 8.1 | No | Memos versions 0.26.0 through 0.30.0 fail to revoke refresh tokens when a user changes their password, allowing attackers to maintain accoun... | 2026-09-08 |
| CVE-2026-84202 | high | 8.8 | No | ModelScope uses PyYAML's unsafe yaml.Loader to parse model configuration files, allowing arbitrary code execution through Python object cons... | 2026-09-08 |
| CVE-2026-84201 | high | 7.1 | No | appium-mcp-server through 0.1.61 fails to validate or normalize file paths in the write_file and write_files_batch tools, allowing attackers... | 2026-09-08 |
| CVE-2026-84194 | not reported | — | No | LibreNMS versions >= 23.10.0 and < 26.2.0 (fixed in 26.4.0) contain an authenticated OS command injection vulnerability in libvirt discovery... | 2026-09-08 |
| CVE-2026-84193 | not reported | — | No | LibreNMS through 26.2.0 contains a stored cross-site scripting vulnerability in legacy PHP template pages that render unescaped SNMP-sourced... | 2026-09-08 |
| CVE-2026-84191 | medium | 6.1 | No | LibreNMS before 26.5.0 contains stored cross-site scripting vulnerabilities in VRF display pages where mplsVpnVrfDescription, vrf_name, and... | 2026-09-08 |
| CVE-2026-84187 | high | 8.2 | No | AVideo contains a missing authentication vulnerability in plugin/Live/on_publish.php that allows unauthenticated attackers to mark arbitrary... | 2026-09-08 |
| CVE-2026-83595 | high | 8.1 | No | AVideo contains a cross-site request forgery vulnerability in plugin/API/set.json.php that allows attackers to perform state-changing action... | 2026-09-08 |
| CVE-2026-86716 | high | 7.3 | No | A vulnerability was determined in Cesanta mJS up to 1.26. Affected is the function skip_spaces_and_comments of the file src/mjs_tok.c. Execu... | 2026-09-08 |