Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113582 | high | 7.5 | No | UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive dat... | 2026-10-30 |
| CVE-2026-114223 | medium | 5.5 | No | NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability. Unauthenticated local attackers can extract... | 2026-10-30 |
| CVE-2026-114222 | medium | 6.2 | No | NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability. Unauthenticated local attackers can bypass the App PIN... | 2026-10-30 |
| CVE-2026-114221 | high | 7.4 | No | NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability. Unauthenticated remote attackers can trigger an HTTP Bas... | 2026-10-30 |
| CVE-2026-113870 | high | 8.8 | No | MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a use... | 2026-10-30 |
| CVE-2026-110305 | high | 7.5 | No | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and includi... | 2026-10-30 |
| CVE-2026-110001 | medium | 5.4 | No | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'alig... | 2026-10-30 |
| CVE-2026-109984 | medium | 5.4 | No | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions... | 2026-10-30 |
| CVE-2026-110732 | high | 7.5 | No | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up... | 2026-10-30 |
| CVE-2026-109891 | medium | 6.4 | No | Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Acc... | 2026-10-30 |
| CVE-2026-110974 | not reported | — | No | The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit: JSONTokener.nextValue()... | 2026-10-30 |
| CVE-2026-109592 | medium | 4.3 | No | The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all ver... | 2026-10-30 |
| CVE-2026-107060 | critical | 9.1 | No | Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN config... | 2026-10-30 |
| CVE-2026-107039 | high | 7.5 | No | Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.33... | 2026-10-30 |
| CVE-2026-107034 | critical | 9.1 | No | Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note dat... | 2026-10-30 |
| CVE-2026-107028 | critical | 9.1 | No | Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leadin... | 2026-10-30 |
| CVE-2026-107023 | medium | 6.5 | No | Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user... | 2026-10-30 |
| CVE-2026-107017 | critical | 9.1 | No | Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigge... | 2026-10-30 |
| CVE-2026-105931 | not reported | — | No | The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization a... | 2026-10-30 |
| CVE-2026-105927 | not reported | — | No | The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer e... | 2026-10-30 |