Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115593 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements... | 2026-10-29 |
| CVE-2026-115591 | high | 7.5 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Retr... | 2026-10-29 |
| CVE-2026-115457 | high | 7.1 | No | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, global shortcode expansion runs over the... | 2026-10-29 |
| CVE-2026-114624 | high | 7.2 | No | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widget... | 2026-10-29 |
| CVE-2026-115355 | high | 7.5 | No | Mistune before 3.3.0 contains a path traversal vulnerability in the Include directive that allows attackers to read arbitrary files by suppl... | 2026-10-29 |
| CVE-2026-115328 | high | 8.8 | No | JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authentica... | 2026-10-29 |
| CVE-2026-111850 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress BuddyPress buddypress allow... | 2026-10-29 |
| CVE-2026-104109 | medium | 6.8 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise validates... | 2026-10-29 |
| CVE-2026-107445 | medium | 5.4 | No | A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remot... | 2026-10-29 |
| CVE-2024-42360 | critical | 9.8 | No | SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints di... | 2026-10-29 |
| CVE-2026-100353 | high | 7.5 | No | kin-openapi is a Go project for handling OpenAPI files. From 0.136.0 until 0.149.0, three openapi3filter decoder paths that were missed by t... | 2026-10-29 |
| CVE-2026-102682 | medium | 5.6 | No | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the p... | 2026-10-29 |
| CVE-2026-114726 | medium | 5.8 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. r... | 2026-10-29 |
| CVE-2026-114728 | medium | 5.3 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes... | 2026-10-29 |
| CVE-2026-112085 | high | 8.2 | No | webpack-dev-server is a development server that provides live reloading for webpack projects. In versions before 5.2.7 and in version 6.0.0,... | 2026-10-29 |
| CVE-2026-114348 | medium | 5.3 | No | webpack-dev-server is a development server that provides live reloading for webpack projects. In versions from 5.1.0 before 5.2.7 and in ver... | 2026-10-29 |
| CVE-2026-94109 | high | 8.0 | No | openEQUELLA before 2026.1.0 contains an authenticated stored server-side template injection vulnerability in FreemarkerPortletRenderer.rende... | 2026-10-29 |
| CVE-2026-90458 | medium | 5.4 | No | OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor_passthru, e.g., to delete accounts from the BMC's Redfish service. | 2026-10-29 |
| CVE-2026-91476 | medium | 5.3 | No | Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: eProcurement). The supported v... | 2026-10-29 |
| CVE-2026-91400 | low | 3.1 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound).... | 2026-10-29 |