Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110843 | not reported | — | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authoriz... | 2026-10-16 |
| CVE-2026-110775 | medium | 6.5 | No | Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenan... | 2026-10-16 |
| CVE-2026-110381 | medium | 6.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows... | 2026-10-16 |
| CVE-2026-110628 | high | 8.6 | No | Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to... | 2026-10-16 |
| CVE-2026-110623 | high | 7.5 | No | Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to shar... | 2026-10-16 |
| CVE-2026-110375 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-mon... | 2026-10-16 |
| CVE-2026-109893 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-... | 2026-10-16 |
| CVE-2026-109221 | high | 8.1 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficien... | 2026-10-16 |
| CVE-2026-109160 | medium | 4.3 | No | A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the f... | 2026-10-16 |
| CVE-2026-109153 | medium | 6.3 | No | A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/chec... | 2026-10-16 |
| CVE-2026-109143 | medium | 5.4 | No | A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the... | 2026-10-16 |
| CVE-2026-109448 | medium | 5.9 | No | Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds... | 2026-10-16 |
| CVE-2026-108933 | low | 2.4 | No | A vulnerability was identified in Edimax BR-6208AC 1.32. Affected is an unknown function of the file /goform/formFilter. Such manipulation l... | 2026-10-16 |
| CVE-2026-108929 | critical | 9.9 | No | A flaw has been found in Netcore NR268 1.7.121109. The affected element is the function execvp of the file /router/DDNSset.cgi of the compon... | 2026-10-16 |
| CVE-2026-108924 | medium | 4.3 | No | A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file... | 2026-10-16 |
| CVE-2026-107659 | high | 7.5 | No | The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u... | 2026-10-16 |
| CVE-2026-105668 | not reported | — | No | Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account... | 2026-10-16 |
| CVE-2026-105443 | high | 8.2 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.10 has insufficient isolation between servers sharing an install. | 2026-10-16 |
| CVE-2026-105280 | not reported | — | No | Improper Validation of Integrity Check Value vulnerability in hexpm hex allows a package mirror to substitute the tarball that mix hex.packa... | 2026-10-16 |
| CVE-2026-104798 | critical | 9.8 | No | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,... | 2026-10-16 |