Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111869 | medium | 5.3 | No | A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulat... | 2026-10-22 |
| CVE-2026-87910 | not reported | — | No | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, th... | 2026-10-22 |
| CVE-2026-98146 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struc... | 2026-10-22 |
| CVE-2026-106053 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-21 |
| CVE-2026-55796 | medium | 6.5 | No | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report cons... | 2026-10-21 |
| CVE-2026-96620 | not reported | — | No | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token withou... | 2026-10-21 |
| CVE-2026-59970 | high | 7.7 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrato... | 2026-10-21 |
| CVE-2026-111921 | medium | 5.4 | No | Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete ad... | 2026-10-21 |
| CVE-2026-111916 | medium | 5.3 | No | Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblink... | 2026-10-21 |
| CVE-2026-111910 | medium | 6.5 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attacke... | 2026-10-21 |
| CVE-2026-111905 | medium | 6.0 | No | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/u... | 2026-10-21 |
| CVE-2026-111900 | medium | 4.3 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to ver... | 2026-10-21 |
| CVE-2026-111894 | medium | 5.4 | No | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated... | 2026-10-21 |
| CVE-2026-111855 | high | 7.5 | No | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interfa... | 2026-10-21 |
| CVE-2026-111719 | medium | 5.9 | No | Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated... | 2026-10-21 |
| CVE-2026-111714 | low | 3.1 | No | tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by... | 2026-10-21 |
| CVE-2026-108372 | not reported | — | No | Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until... | 2026-10-21 |
| CVE-2026-111709 | medium | 5.4 | No | WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to ac... | 2026-10-21 |
| CVE-2026-111704 | critical | 9.8 | No | LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST... | 2026-10-21 |
| CVE-2026-112912 | low | 2.5 | No | filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the... | 2026-10-21 |