Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54859 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Preservation <= 1.15 versions. | 2026-10-29 |
| CVE-2026-42692 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | 2026-10-29 |
| CVE-2026-25448 | medium | 4.3 | No | Missing Authorization vulnerability in weDevs WP ERP erp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue... | 2026-10-29 |
| CVE-2026-118081 | high | 8.8 | No | Contributor PHP Object Injection in 10Web Social Photo Feed <= 1.5.6 versions. | 2026-10-29 |
| CVE-2026-118076 | high | 8.8 | No | Contributor PHP Object Injection in Frisbii Pay <= 1.8.19 versions. | 2026-10-29 |
| CVE-2026-116868 | high | 8.8 | No | Subscriber PHP Object Injection in BuddyPress Xprofile Custom Field Types <= 1.3.1 versions. | 2026-10-29 |
| CVE-2026-118097 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & HTML5 Video html5-vid... | 2026-10-29 |
| CVE-2026-116197 | low | 2.6 | No | Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wild... | 2026-10-29 |
| CVE-2026-116193 | medium | 5.3 | No | Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip au... | 2026-10-29 |
| CVE-2026-116189 | high | 7.5 | No | rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes pre... | 2026-10-29 |
| CVE-2026-116181 | medium | 6.5 | No | vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to crash the engine by suppl... | 2026-10-29 |
| CVE-2026-116177 | high | 7.5 | No | vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhaust... | 2026-10-29 |
| CVE-2026-116169 | medium | 5.4 | No | SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit permission to inject script... | 2026-10-29 |
| CVE-2026-116165 | not reported | — | No | Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB deployments that lets... | 2026-10-29 |
| CVE-2026-116161 | not reported | — | No | Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in LiveQuery. Its subscription... | 2026-10-29 |
| CVE-2026-116136 | medium | 5.9 | No | ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share... | 2026-10-29 |
| CVE-2026-116070 | medium | 6.5 | No | Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated atta... | 2026-10-29 |
| CVE-2026-116066 | medium | 6.8 | No | Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to... | 2026-10-29 |
| CVE-2026-116050 | high | 7.3 | No | A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unk... | 2026-10-29 |
| CVE-2026-116047 | medium | 4.3 | No | A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the... | 2026-10-29 |