Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55252 | not reported | — | No | OpenRun is an open-source, self-hosted GitOps platform for deploying web apps and internal tools to Docker or Kubernetes. Prior to version 0... | 2026-10-16 |
| CVE-2026-111722 | high | 8.1 | No | LingGuo-Drama through commit 8a6924a contains an insecure direct object reference vulnerability that allows registered users to access other... | 2026-10-16 |
| CVE-2026-111717 | medium | 4.3 | No | Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated employees to read other... | 2026-10-16 |
| CVE-2026-111712 | medium | 6.5 | No | Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated attackers to reach protected... | 2026-10-16 |
| CVE-2026-111707 | medium | 5.3 | No | 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read other users' cha... | 2026-10-16 |
| CVE-2026-111702 | high | 7.5 | No | ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote attackers to access other us... | 2026-10-16 |
| CVE-2026-111697 | medium | 6.5 | No | HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp MeController and OrderControlle... | 2026-10-16 |
| CVE-2026-13138 | high | 8.6 | No | Client-Side Enforcement of Server-Side Security vulnerability in Divasoft Software and E-Commerce Inc. Biletiva Ticketing Platform allows Ma... | 2026-10-16 |
| CVE-2026-15398 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-82223 Reason: This candidate is a reservation duplicate... | 2026-10-16 |
| CVE-2026-15354 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-32566. Reason: This candidate is a reservation duplicat... | 2026-10-16 |
| CVE-2026-111672 | medium | 4.3 | No | Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that allows authenticated user... | 2026-10-16 |
| CVE-2026-111667 | medium | 4.3 | No | REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows authenticated low-priv... | 2026-10-16 |
| CVE-2026-111347 | medium | 5.9 | No | go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects encrypted login passwords... | 2026-10-16 |
| CVE-2026-111323 | medium | 5.3 | No | RedAmon through 7.0.1 contains an unauthenticated server-side request forgery vulnerability in the agent POST /tradecraft/verify endpoint be... | 2026-10-16 |
| CVE-2026-111282 | high | 8.2 | No | Driftregion iso14229 before 0.10.1 contains an integer wraparound in Handle_0x38_RequestFileTransfer that lets unauthenticated attackers byp... | 2026-10-16 |
| CVE-2026-110812 | critical | 9.9 | No | Deserialization of untrusted data in the Gremlin graph data import component in Amazon Neptune engine might allow an authenticated remote ac... | 2026-10-16 |
| CVE-2026-110724 | high | 7.5 | No | In `api-gateway` versions till `1.7.3`, The default rate-limit key resolver, `ClientIpKeyResolver`, derives the per-client bucket key from t... | 2026-10-16 |
| CVE-2026-109722 | high | 8.1 | No | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153... | 2026-10-16 |
| CVE-2026-109716 | high | 8.1 | No | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox E... | 2026-10-16 |
| CVE-2026-109715 | high | 8.1 | No | Incorrect boundary conditions in the JavaScript Engine component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox E... | 2026-10-16 |