Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96852 | high | 7.0 | No | Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges locally. | 2026-10-16 |
| CVE-2026-111212 | medium | 4.8 | No | A security flaw has been discovered in ImprintLab Medical-SAM-Adapter 0.1.0-alpha/0.1.0. Affected by this issue is the function session.get_... | 2026-10-16 |
| CVE-2026-109320 | medium | 5.4 | No | The Grav API plugin (grav-plugin-api) before 1.0.36 contains an improper session validation vulnerability that allows disabled accounts to k... | 2026-10-16 |
| CVE-2026-109398 | high | 7.5 | No | Gumlet php-image-resize before 3.0.1 contains a denial of service vulnerability because the ImageResize constructor in lib/ImageResize.php p... | 2026-10-16 |
| CVE-2026-108699 | medium | 6.5 | No | hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugin... | 2026-10-16 |
| CVE-2026-108758 | high | 8.2 | No | Easy!Appointments through 1.6.0 contains an authorization bypass vulnerability in Booking::register() that allows unauthenticated attackers... | 2026-10-16 |
| CVE-2026-108688 | medium | 4.3 | No | Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privi... | 2026-10-16 |
| CVE-2026-108600 | medium | 4.7 | No | open-multi-agent (@open-multi-agent/core) 1.5.0 through 1.21.2 contains a link following vulnerability in the file_write tool sandbox that a... | 2026-10-16 |
| CVE-2026-108595 | medium | 5.3 | No | Phi 0.3.0 through 0.28.4 contains a permission bypass vulnerability that allows spawned sub-agents to escape workspace_only_writes and reado... | 2026-10-16 |
| CVE-2026-108586 | medium | 5.4 | No | 1MCP Agent (@1mcp/agent) 0.20.0 through 0.39.0 contains an incorrect authorization vulnerability that allows authenticated clients to bypass... | 2026-10-16 |
| CVE-2026-108580 | medium | 6.5 | No | AniWorld Downloader before 5.3.0 contains an improper restriction of authentication attempts vulnerability in the WebUI /login POST handler... | 2026-10-16 |
| CVE-2026-108551 | critical | 9.8 | No | openapi-typescript-codegen through 0.31.0 contains a code injection vulnerability that allows attackers controlling an OpenAPI document to i... | 2026-10-16 |
| CVE-2026-108546 | high | 7.5 | No | Spotweb through 1.5.8 contains an OS command injection vulnerability in the runcommand NZB handler that allows remote attackers to execute c... | 2026-10-16 |
| CVE-2026-111210 | high | 7.3 | No | A vulnerability was determined in bitcoinj up to 0.17. Affected is the function url.openConnection of the file PaymentSession.java of the co... | 2026-10-16 |
| CVE-2026-111096 | medium | 5.4 | No | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible | 2026-10-16 |
| CVE-2026-111095 | medium | 5.4 | No | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible | 2026-10-16 |
| CVE-2026-111094 | critical | 9.8 | No | In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was p... | 2026-10-16 |
| CVE-2026-110712 | medium | 6.5 | No | libsmb2 through 6.2 contains a heap out-of-bounds read vulnerability in smb2_decode_file_all_info that allows malicious SMB servers to crash... | 2026-10-16 |
| CVE-2026-110657 | low | 3.3 | No | Khronos NNEF-Tools nnef through 1.0.10 and nnef-tools through 1.0.11 contain a path traversal vulnerability that allows attackers to write f... | 2026-10-16 |
| CVE-2026-110649 | critical | 9.8 | No | Stills before 25.24.2 contains an OS command injection vulnerability that allows attackers to execute shell commands by supplying crafted me... | 2026-10-16 |