Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85538 | not reported | — | No | An incorrect authorization vulnerability in MISP allowed authenticated users to delete attributes from events despite lacking the required p... | 2026-09-08 |
| CVE-2026-85533 | not reported | — | No | An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to u... | 2026-09-08 |
| CVE-2026-15937 | not reported | — | No | Improper certificate validation in Checkmk <2.5.0p10 allows a relay and a push agent that share the same UUID to reuse each other's mTLS cer... | 2026-09-08 |
| CVE-2026-15933 | not reported | — | No | OptimiDoc Server (On-Premise) stores credentials for external services in cleartext. An authenticated administrator can view previously conf... | 2026-09-08 |
| CVE-2026-77654 | not reported | — | No | Improper Privilege Management vulnerability in Horizon Security Analyzer (formerly AlgoSec Firewall Analyzer) on Linux, 64 bit allows Privil... | 2026-09-08 |
| CVE-2026-14466 | medium | 4.3 | No | It’s possible to run a stored XSS in Stormshield’s web administration panel. To exploit this vulnerability, a SNS administrator with approp... | 2026-09-08 |
| CVE-2026-85094 | high | 8.8 | No | The Canva Android App before 2.376.0 did not restrict the headers returned to an external origin running in a privileged WebView. A threat a... | 2026-09-08 |
| CVE-2026-85085 | critical | 9.6 | No | The Canva Android App before 2.376.0 allowed an external origin to be loaded in a privileged WebView. A threat actor who controls the page l... | 2026-09-08 |
| CVE-2026-85786 | high | 7.5 | No | Improper handling of highly compressed data in Amazon ion-java before 1.12.1 might allow remote attackers to cause a denial of service via a... | 2026-09-08 |
| CVE-2026-85781 | high | 8.7 | No | Unverified ownership of a storage access point in the volume deletion component of the Amazon EFS CSI Driver before v3.4.1 might allow an au... | 2026-09-08 |
| CVE-2026-85656 | high | 7.8 | No | An OS command injection issue in the log4j-cve-2021-44228-hotpatch package in Amazon Linux before 1.3-9 might allow a local user to execute... | 2026-09-08 |
| CVE-2026-85654 | high | 7.8 | No | Improper neutralization of special elements used in a template engine in the CDK generator in Amazon awslabs.dynamodb-mcp-server before 2.1.... | 2026-09-08 |
| CVE-2026-85028 | high | 7.8 | No | Creation of a temporary file in a directory with insecure permissions in the FPGA management tool installation component in AWS FPGA Develop... | 2026-09-08 |
| CVE-2026-85012 | high | 8.0 | No | Improper neutralization of special elements used in an OS command (CWE-78) in the blueprint resynthesis framework in Amazon Web Services cod... | 2026-09-08 |
| CVE-2026-80190 | medium | 6.1 | No | Apache Allura: stored XSS via SVN code repositories. Git repositories are not known to be affected. The vulnerability is likely mitigated vi... | 2026-09-08 |
| CVE-2026-81270 | high | 7.5 | No | Apache Allura: exposure of non-public information via search. This issue affects Apache Allura: through 1.20.0. Users are recommended to u... | 2026-09-08 |
| CVE-2026-80180 | medium | 6.1 | No | Stored XSS via markdown HTML processing in Apache Allura. This issue affects Apache Allura: from through 1.20.0. Users are recommended to... | 2026-09-08 |
| CVE-2026-9331 | high | 7.1 | No | The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a den... | 2026-09-08 |
| CVE-2026-86321 | medium | 5.3 | No | A vulnerability was found in java-json-tools jackson-coreutils 2.0. Affected by this issue is the function JsonLoader.fromURL of the file sr... | 2026-09-08 |
| CVE-2026-86309 | medium | 6.3 | No | A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro_searchfrm.php.... | 2026-09-08 |