Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-113599 | medium | 5.4 | No | Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply message... | 2026-10-20 |
| CVE-2026-113597 | medium | 5.4 | No | Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to re... | 2026-10-20 |
| CVE-2026-113594 | medium | 5.4 | No | Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by... | 2026-10-20 |
| CVE-2026-113358 | high | 7.5 | No | LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to dow... | 2026-10-20 |
| CVE-2026-113357 | low | 3.5 | No | @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports... | 2026-10-20 |
| CVE-2026-113352 | high | 7.5 | No | uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file... | 2026-10-20 |
| CVE-2026-112148 | not reported | — | No | A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an... | 2026-10-20 |
| CVE-2026-77938 | medium | 6.5 | No | Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSa... | 2026-10-20 |
| CVE-2026-77937 | high | 8.1 | No | Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-... | 2026-10-20 |
| CVE-2026-77926 | high | 8.8 | No | Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands throu... | 2026-10-20 |
| CVE-2026-109443 | high | 8.8 | No | JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via... | 2026-10-20 |
| CVE-2026-109442 | critical | 9.8 | No | piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stre... | 2026-10-20 |
| CVE-2026-109441 | medium | 5.8 | No | LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared def... | 2026-10-20 |
| CVE-2026-97163 | critical | 9.8 | No | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-105772 | not reported | — | No | Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenti... | 2026-10-20 |
| CVE-2026-92539 | medium | 6.7 | No | A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organiza... | 2026-10-20 |
| CVE-2026-113681 | medium | 5.5 | No | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that... | 2026-10-20 |
| CVE-2026-113679 | high | 7.0 | No | HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to... | 2026-10-20 |
| CVE-2026-113607 | medium | 6.5 | No | Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read re... | 2026-10-20 |
| CVE-2026-113605 | high | 7.2 | No | Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to... | 2026-10-20 |