Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111699 | medium | 4.8 | No | Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans... | 2026-10-21 |
| CVE-2026-111694 | medium | 5.3 | No | qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow... | 2026-10-21 |
| CVE-2026-111689 | medium | 4.3 | No | Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any depart... | 2026-10-21 |
| CVE-2026-111684 | high | 8.3 | No | Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revo... | 2026-10-21 |
| CVE-2026-111679 | medium | 5.4 | No | Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and cle... | 2026-10-21 |
| CVE-2026-111674 | medium | 4.3 | No | Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images throug... | 2026-10-21 |
| CVE-2026-111669 | medium | 6.5 | No | ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by... | 2026-10-21 |
| CVE-2026-111664 | medium | 4.4 | No | Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by c... | 2026-10-21 |
| CVE-2026-111659 | medium | 6.5 | No | Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling... | 2026-10-21 |
| CVE-2026-111654 | medium | 6.3 | No | FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated low-privilege users to access oth... | 2026-10-21 |
| CVE-2026-111649 | medium | 6.5 | No | Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in DownloadAttachment that allows authent... | 2026-10-21 |
| CVE-2026-111644 | high | 7.3 | No | Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers to access audit, dia... | 2026-10-21 |
| CVE-2026-111639 | high | 8.1 | No | bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that allows remote attackers... | 2026-10-21 |
| CVE-2026-111634 | high | 8.1 | No | Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL through unescaped repo... | 2026-10-21 |
| CVE-2026-111629 | medium | 4.3 | No | IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to read other tenants'... | 2026-10-21 |
| CVE-2026-111624 | low | 3.7 | No | Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients to connect to the ba... | 2026-10-21 |
| CVE-2026-111619 | medium | 6.5 | No | FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject SQL into ORDER BY cl... | 2026-10-21 |
| CVE-2026-111614 | medium | 6.5 | No | DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath that allows authenticat... | 2026-10-21 |
| CVE-2026-112914 | medium | 5.3 | No | filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock can restore a stale marker by name after movin... | 2026-10-21 |
| CVE-2026-101687 | high | 7.5 | No | Vulnerability in the Oracle E-Business Suite Integrated SOA Gateway product of Oracle E-Business Suite (component: SOA Provider). Supported... | 2026-10-21 |