Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-57169 | critical | 9.6 | No | Dockhand is a Docker management application. Prior to 1.0.34, the in-browser container terminal endpoint /api/containers//exec does not enfo... | 2026-10-28 |
| CVE-2026-57446 | medium | 5.3 | No | libIEC61850 is an open-source implementation of IEC 61850 client and server protocols including MMS, GOOSE, Sampled Values, and R-Session. F... | 2026-10-28 |
| CVE-2026-55543 | not reported | — | No | TuxGuitar is an open-source guitar tablature editor. Prior to 2.1.0, an untrusted .tg file can set gervil.soundbank.path to reference an on-... | 2026-10-28 |
| CVE-2026-116171 | medium | 4.4 | No | SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows extended-length prefix... | 2026-10-28 |
| CVE-2026-114662 | high | 8.1 | No | Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated attackers to steal API... | 2026-10-28 |
| CVE-2026-114658 | high | 8.8 | No | Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that allows page authors... | 2026-10-28 |
| CVE-2026-114641 | low | 3.7 | No | Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend authentication, where... | 2026-10-28 |
| CVE-2026-114637 | high | 8.7 | No | Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy connection pool, which fail... | 2026-10-28 |
| CVE-2026-114633 | medium | 6.5 | No | WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts to delete or modify a... | 2026-10-28 |
| CVE-2026-114575 | critical | 10.0 | No | A flaw has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this issue is the function UploadCustomModule of the file lib/c... | 2026-10-28 |
| CVE-2026-114509 | not reported | — | No | Laravel is a web application framework. Prior to 12.68.0 and 13.29.0, TokenGuard configured as a standard token-based API guard does not rej... | 2026-10-28 |
| CVE-2026-114440 | high | 7.3 | No | A vulnerability was identified in oretnom23 php-travel-agency-system. This affects an unknown part of the file admin/delete.php. The manipul... | 2026-10-28 |
| CVE-2026-114383 | critical | 10.0 | No | A weakness has been identified in TOTOLINK EX200 5.2.3c.7200. This impacts the function setWiFiAclAddConfig of the file /cgi-bin/cstecgi.cgi... | 2026-10-28 |
| CVE-2026-114380 | medium | 6.3 | No | A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. Impacted is an unknown function of the file /inserttrans.php. Per... | 2026-10-28 |
| CVE-2026-114377 | low | 3.8 | No | A security vulnerability has been detected in leomoon-studios wiki-go up to 1.9.1. Affected by this issue is the function DeleteComment of t... | 2026-10-28 |
| CVE-2026-114142 | not reported | — | No | toml-node is a TOML parser for Node.js and the browser. Prior to 5.0.1, toml.parse() can write attacker-controlled properties to Object.prot... | 2026-10-28 |
| CVE-2026-114374 | medium | 4.3 | No | A vulnerability was identified in leomoon-studios wiki-go up to 1.9.1. This impacts an unknown function of the file internal/handlers/metada... | 2026-10-28 |
| CVE-2026-114268 | critical | 9.9 | No | A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/Wif... | 2026-10-28 |
| CVE-2026-114138 | high | 7.5 | No | Django REST framework is a toolkit for building Web APIs. Prior to 3.18.2, DefaultContentNegotiation.get_accept_list in rest_framework/negot... | 2026-10-28 |
| CVE-2026-102923 | medium | 5.4 | No | SparkyFitness is a self-hosted, AI-powered health and fitness tracker for families. Prior to 1.6.0, SparkyFitnessServer/services/chatService... | 2026-10-28 |