Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55842 | medium | 5.4 | No | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.1, the apiCorsConfiguration() method in src/main/java/com/erudika/... | 2026-10-16 |
| CVE-2026-57568 | not reported | — | No | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to sto... | 2026-10-16 |
| CVE-2026-53582 | high | 7.1 | No | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.10, the Trust module stores attacker-controlled certificate... | 2026-10-16 |
| CVE-2026-55154 | medium | 5.4 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, application/Espo/Tools/Export/Format/Csv/Processor.p... | 2026-10-16 |
| CVE-2026-12272 | medium | 5.3 | No | The Lightweight Cookie Notice – Cookie Banner for Cookie Consent plugin for WordPress is vulnerable to Sensitive Information Exposure in all... | 2026-10-16 |
| CVE-2026-46694 | medium | 6.5 | No | EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record... | 2026-10-16 |
| CVE-2026-21119 | not reported | — | No | Out-of-bounds read and write in lib_sag_ai_sound_sep_v2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-o... | 2026-10-16 |
| CVE-2026-111387 | medium | 6.5 | No | Nezha from 2.2.5 before 2.3.15 contains an information disclosure vulnerability that allows authenticated users to retrieve third-party cred... | 2026-10-16 |
| CVE-2026-111278 | medium | 5.3 | No | NivoCart through 2.5.1 contains a CAPTCHA bypass vulnerability that allows unauthenticated attackers to defeat form protection because the e... | 2026-10-16 |
| CVE-2026-111224 | high | 7.5 | No | pfSense CE through 2.9.0 contains an OS command injection vulnerability in the OpenVPN openvpn.connect_async.sh script that allows authentic... | 2026-10-16 |
| CVE-2026-111157 | medium | 6.1 | No | SoX through 14.4.2 contains a heap out-of-bounds write vulnerability in lsx_ms_adpcm_block_expand_i() in src/adpcm.c, triggered by an odd sa... | 2026-10-16 |
| CVE-2026-111142 | medium | 5.5 | No | Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a... | 2026-10-16 |
| CVE-2026-111132 | medium | 6.1 | No | GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocatio... | 2026-10-16 |
| CVE-2026-110888 | medium | 4.3 | No | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels... | 2026-10-16 |
| CVE-2026-110873 | high | 7.1 | No | Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's err... | 2026-10-16 |
| CVE-2026-110868 | high | 8.5 | No | Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitr... | 2026-10-16 |
| CVE-2026-110863 | high | 8.1 | No | Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to... | 2026-10-16 |
| CVE-2026-110858 | high | 8.1 | No | GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only k... | 2026-10-16 |
| CVE-2026-110853 | not reported | — | No | n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying... | 2026-10-16 |
| CVE-2026-110848 | not reported | — | No | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, wh... | 2026-10-16 |