| CVE ID | Title | Vendor | Product | Severity | CVSS Score | Published At | AI Analysis |
|---|---|---|---|---|---|---|---|
| CVE-2026-102992 | piscina: Prototype-pollution gadget in ThreadPool.options allows RCE via execArgv / loadBalancer / env | piscinajs | piscina | Critical | 9.2 | 2026-09-30 19:50:18 | Deep Dive |
| CVE-2026-102991 | Mako: Path traversal via drive-letter URI on Windows in TemplateLookup | sqlalchemy | mako | Medium | 6.5 | 2026-09-30 19:47:07 | Deep Dive |
| CVE-2026-103548 | Improperly Stored Credentials | Itron | MV-90 xi | Medium | 5.3 | 2026-09-30 19:45:14 | Deep Dive |
| CVE-2026-103387 | garycourt uri-js Mailto Header mailto.ts URI.parse uncaught exception | garycourt | uri-js | Medium | 4.3 | 2026-09-30 19:45:08 | Deep Dive |
| CVE-2026-102990 | basic-ftp: Quadratic-time CPU denial of service in Client.list() Unix directory-listing parser (RE_LINE backtracking) | patrickjuchli | basic-ftp | High | 8.2 | 2026-09-30 19:44:47 | Deep Dive |
| CVE-2026-103547 | OpenBSD 7.8/7.9 ldapd认证混淆及空指针漏洞 | OpenBSD | OpenBSD | Critical | 9.2 | 2026-09-30 19:40:53 | Deep Dive |
| CVE-2026-101885 | ZeroClaw before 0.8.5 Path Traversal via Plugin Manifest wasm_path | zeroclaw-labs | ZeroClaw | High | 7.8 | 2026-09-30 19:16:05 | Deep Dive |
| CVE-2026-101884 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via Environment Override | OpenClaw | OpenClaw Windows Node | High | 7.5 | 2026-09-30 19:16:05 | Deep Dive |
| CVE-2026-101883 | OpenClaw Windows Node through 2026.9.4 SSRF via canvas.present | OpenClaw | OpenClaw Windows Node | Medium | 5.4 | 2026-09-30 19:16:04 | Deep Dive |
| CVE-2026-101882 | OpenClaw Windows Node before 2026.7.1 Remote Code Execution via system.execApprovals.set | OpenClaw | OpenClaw Windows Node | High | 8.8 | 2026-09-30 19:16:03 | Deep Dive |
| CVE-2026-101880 | OpenClaw Windows Node before 2026.7.1 Authorization Bypass | OpenClaw | OpenClaw Windows Node | High | 8.8 | 2026-09-30 19:16:02 | Deep Dive |
| CVE-2026-101881 | OpenClaw Windows Node before 2026.7.1 Denial of Service | OpenClaw | OpenClaw Windows Node | Medium | 6.5 | 2026-09-30 19:16:02 | Deep Dive |
| CVE-2026-101879 | OpenClaw Windows Node before 2026.7.1-3 Missing Authorization | OpenClaw | OpenClaw Windows Node | Medium | 6.5 | 2026-09-30 19:16:01 | Deep Dive |
| CVE-2026-103399 | Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body | Red Hat | Red Hat Enterprise Linux 10 | Medium | 5.3 | 2026-09-30 17:42:31 | Deep Dive |
| CVE-2026-102392 | WordPress Extra Product Options For WooCommerce | Custom Product Addons and Fields plugin <= 3.3.8 - PHP Object Injection vulnerability | ThemeHigh | Extra Product Options For WooCommerce | Custom Product Addons and Fields | High | 7.2 | 2026-09-30 17:39:08 | Deep Dive |
| CVE-2026-102391 | WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability | jetmonsters | JetFormBuilder | High | 7.1 | 2026-09-30 17:39:07 | Deep Dive |
| CVE-2026-102377 | WordPress Photo Gallery by 10Web plugin <= 1.8.46 - PHP Object Injection vulnerability | 10Web | Photo Gallery by 10Web | High | 8.8 | 2026-09-30 17:39:07 | Deep Dive |
| CVE-2026-102376 | WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability | WPMU DEV | Branda | High | 7.1 | 2026-09-30 17:39:06 | Deep Dive |
| CVE-2026-102375 | WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability | Optimole | Optimole | Medium | 6.5 | 2026-09-30 17:39:05 | Deep Dive |
| CVE-2026-100510 | WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability | BoldGrid | Post and Page Builder by BoldGrid | High | 7.1 | 2026-09-30 17:39:04 | Deep Dive |