Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73776 | high | 7.9 | No | A signature verification bypass vulnerability exists in the command line interface of AOS-CX. Successful exploitation could allow an authent... | 2026-09-04 |
| CVE-2026-73777 | high | 8.1 | No | Vulnerabilities have been identified in the API endpoint of AOS-CX switches that could potentially allow an unauthenticated remote actor to... | 2026-09-04 |
| CVE-2026-73779 | high | 8.2 | No | Vulnerabilities have been identified in the operating system of AOS-CX switches that could potentially allow an unauthenticated remote actor... | 2026-09-04 |
| CVE-2026-73782 | high | 8.8 | No | A format string vulnerability exists in the command line interface of AOS-CX that could lead to unauthenticated remote code execution. Succe... | 2026-09-04 |
| CVE-2026-73781 | high | 8.4 | No | A vulnerability in the web-based management interface of AOS-CX could allow an authenticated remote attacker to conduct a stored cross-site... | 2026-09-04 |
| CVE-2026-85222 | critical | 9.1 | No | A vulnerability has been found in D-Link DNS-340L 1.01B04. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/a... | 2026-09-04 |
| CVE-2026-85306 | medium | 6.5 | No | Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configure... | 2026-09-04 |
| CVE-2026-85186 | medium | 6.3 | No | A weakness has been identified in itsourcecode Online Medicine Delivery System 1.0. Affected by this vulnerability is the function doupdatei... | 2026-09-04 |
| CVE-2026-84848 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Quick Event Manager <= 9.17 versions. | 2026-09-04 |
| CVE-2026-84813 | critical | 9.3 | No | Unauthenticated SQL Injection in GeoDirectory <= 2.8.174 versions. | 2026-09-04 |
| CVE-2026-84776 | high | 7.5 | No | Unauthenticated Denial of Service Attack in MalCare Security <= 6.69 versions. | 2026-09-04 |
| CVE-2026-84767 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions. | 2026-09-04 |
| CVE-2026-84761 | high | 7.2 | No | Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. | 2026-09-04 |
| CVE-2026-84754 | medium | 6.5 | No | Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | 2026-09-04 |
| CVE-2026-81776 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | 2026-09-04 |
| CVE-2026-81282 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | 2026-09-04 |
| CVE-2019-3773 | critical | 9.8 | No | Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity In... | 2026-09-04 |
| CVE-2026-33228 | critical | 9.8 | No | flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from th... | 2026-09-04 |
| CVE-2026-80752 | high | 8.4 | No | In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() re... | 2026-09-04 |
| CVE-2026-80751 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk... | 2026-09-04 |