Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62804 | high | 7.8 | No | External control of file name or path in Microsoft Office Word allows an unauthorized attacker to execute code locally. | 2026-09-08 |
| CVE-2026-80119 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an inform... | 2026-09-08 |
| CVE-2026-80117 | high | 7.1 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privile... | 2026-09-08 |
| CVE-2026-80116 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a privile... | 2026-09-08 |
| CVE-2026-80114 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain a hard-co... | 2026-09-08 |
| CVE-2026-80112 | high | 7.8 | No | PassMark PerformanceTest before 11.1 build 1012, BurnInTest before 11.1 build 1000, and OSForensics before 11.1 build 1016 contain an improp... | 2026-09-08 |
| CVE-2026-74236 | medium | 6.5 | No | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the diagnostic file deletion handler. The unlink_or_emai... | 2026-09-08 |
| CVE-2026-74235 | medium | 4.9 | No | GFI Exinda AI and ClearView before 7.6.5 contains a path traversal vulnerability in the system maintenance configuration download handler. T... | 2026-09-08 |
| CVE-2026-85452 | high | 8.8 | No | MOOS ui-moos through 50b9c6c contains a buffer overflow vulnerability in ScopeTabPane.cpp and ScopeGrid.cpp where client and variable names... | 2026-09-08 |
| CVE-2026-85426 | critical | 9.8 | No | MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can injec... | 2026-09-08 |
| CVE-2022-51008 | medium | 5.3 | No | PocketMine-MP before 4.12.3 fails to limit unauthenticated sessions, allowing attackers to exhaust player slots by creating sessions without... | 2026-09-08 |
| CVE-2026-86196 | not reported | — | No | Grav API plugin versions before 1.0.20 build password reset links from the untrusted Host header in the forgot-password endpoint, allowing u... | 2026-09-08 |
| CVE-2026-86195 | not reported | — | No | grav-plugin-api versions before 1.0.20 contain a privilege escalation vulnerability in the InvitationsController where the stripSuperFlags()... | 2026-09-08 |
| CVE-2026-86193 | not reported | — | No | grav-plugin-api before 1.0.20 fails to validate group-inherited super permissions in user-management guards, allowing non-super user manager... | 2026-09-08 |
| CVE-2026-86191 | medium | 4.3 | No | SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish r... | 2026-09-08 |
| CVE-2026-86190 | critical | 9.1 | No | WWBN AVideo contains a broken access control vulnerability in videoViewsInfo endpoints that returns complete user records including password... | 2026-09-08 |
| CVE-2026-86188 | high | 7.2 | No | AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary J... | 2026-09-08 |
| CVE-2026-86186 | medium | 6.5 | No | AVideo API fails to enforce rate limits when clients send a bot User-Agent header, allowing attackers to bypass all eight protected operatio... | 2026-09-08 |
| CVE-2026-86113 | medium | 6.5 | No | BookWyrm through 0.9.1 contains an authorization bypass vulnerability in the edit_readthrough function that allows authenticated users to mo... | 2026-09-08 |
| CVE-2026-86111 | medium | 6.5 | No | BookWyrm through 0.9.1 fails to validate user visibility permissions in the status edit endpoint, allowing authenticated attackers to read f... | 2026-09-08 |