Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86254 | medium | 6.8 | No | wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym... | 2026-09-08 |
| CVE-2026-86711 | high | 7.4 | No | electerm before 5.3.15 exposes 40+ main-process functions through an unvalidated Electron IPC handler with no function-name allowlist or sen... | 2026-09-08 |
| CVE-2026-86542 | critical | 9.1 | No | knowns before 0.30.0 fails to validate import names in the import routes, allowing unauthenticated attackers to write files outside the impo... | 2026-09-08 |
| CVE-2026-86540 | high | 7.8 | No | knowns versions before 0.30.0 fail to validate the settings.lsp.languages binary field in project configuration files, allowing attackers to... | 2026-09-08 |
| CVE-2026-86439 | high | 8.8 | No | knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and del... | 2026-09-08 |
| CVE-2026-86437 | high | 7.2 | No | Lara Dashboard before 1.3.2 authorizes the POST /admin/settings/core-upgrades/upload endpoint with only the settings.edit permission, allowi... | 2026-09-08 |
| CVE-2026-86713 | high | 7.1 | No | PX4 Autopilot through 1.17.0 contains a use-after-free vulnerability in the load_mon module's stop path where exit_and_cleanup() deletes the... | 2026-09-08 |
| CVE-2026-86730 | high | 8.8 | No | Craft CMS versions before 5.10.12 fail to properly cleanse string-typed field-layout elements, allowing authenticated control-panel users to... | 2026-09-08 |
| CVE-2026-86728 | high | 7.5 | No | AVideo through 29.0 contains an authentication bypass vulnerability in plugin/PlayLists/epg.json.php that exposes live-stream keys and priva... | 2026-09-08 |
| CVE-2026-86725 | high | 7.1 | No | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in the SocialMediaPublisher plugin's... | 2026-09-08 |
| CVE-2026-86723 | high | 8.1 | No | AVideo through c3edcc274c389816d434acadac07ee78eaf330c1 contains an authentication bypass vulnerability in LoginControl::verifyChallenge() t... | 2026-09-08 |
| CVE-2026-86720 | high | 8.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ownership of live_restreams_id in resendRestreamer.jso... | 2026-09-08 |
| CVE-2026-86718 | high | 7.1 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in deleteHistory.jso... | 2026-09-08 |
| CVE-2026-18073 | medium | 4.4 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to inject parameters into a CL command due to improper neutralizatio... | 2026-09-08 |
| CVE-2026-18078 | medium | 6.5 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to an integer overflow. | 2026-09-08 |
| CVE-2026-67397 | not reported | — | No | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. | 2026-09-08 |
| CVE-2021-44320 | high | 7.5 | No | Parrot AR.Drone version 1 and 2 does not employ a suitable mechanism to prevent denial-of-service (DoS) attacks. An attacker can harm the de... | 2026-09-08 |
| CVE-2026-75430 | critical | 9.8 | No | PowerJob Worker version 5.1.2 (and likely earlier versions) exposes the /worker/deployContainer HTTP endpoint without authentication on the... | 2026-09-08 |
| CVE-2026-31020 | critical | 9.8 | No | In DocsGPT 0.15.0 and below, the application provides a custom prompt feature that allows users to define prompt content used during chatbot... | 2026-09-08 |
| CVE-2026-78970 | medium | 6.5 | No | JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker w... | 2026-09-08 |