Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111728 | medium | 5.4 | No | Seanime v3.7.0 to v3.10.3 contains an argument injection vulnerability reachable through improper authorization, allowing unauthenticated LA... | 2026-10-16 |
| CVE-2026-111369 | high | 7.1 | No | ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson routes that allows any c... | 2026-10-16 |
| CVE-2026-111368 | medium | 6.4 | No | ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission routes that allows co... | 2026-10-16 |
| CVE-2026-111366 | high | 7.2 | No | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to manage users outside... | 2026-10-16 |
| CVE-2026-111365 | medium | 6.0 | No | cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to read, modify, or delete... | 2026-10-16 |
| CVE-2026-111364 | medium | 6.5 | No | MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that allows authenticated... | 2026-10-16 |
| CVE-2026-111358 | medium | 5.4 | No | SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated workspace members to attac... | 2026-10-16 |
| CVE-2026-111356 | high | 7.4 | No | MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing unauthenticated attackers to tak... | 2026-10-16 |
| CVE-2026-111355 | medium | 6.3 | No | zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to ignore department DataSc... | 2026-10-16 |
| CVE-2026-111354 | low | 3.1 | No | crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other members' orders by sup... | 2026-10-16 |
| CVE-2026-111350 | medium | 5.0 | No | Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to... | 2026-10-16 |
| CVE-2026-111349 | medium | 5.3 | No | Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to... | 2026-10-16 |
| CVE-2026-111346 | medium | 5.4 | No | ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated users to read and ov... | 2026-10-16 |
| CVE-2026-111345 | medium | 4.3 | No | Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read private conversations by su... | 2026-10-16 |
| CVE-2026-111330 | medium | 5.9 | No | JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 diges... | 2026-10-16 |
| CVE-2026-111329 | critical | 9.8 | No | JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access... | 2026-10-16 |
| CVE-2026-111321 | medium | 5.4 | No | TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send ar... | 2026-10-16 |
| CVE-2026-111320 | medium | 6.5 | No | ValueCell through 0.1.20 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to direct backen... | 2026-10-16 |
| CVE-2026-111272 | medium | 5.5 | No | LibRaw through 0.22.2 contains a heap-based out-of-bounds read in LibRaw::parseNikonMakernote() that allows attackers to read past a short S... | 2026-10-16 |
| CVE-2026-111271 | medium | 5.5 | No | libmodplug through 0.8.9.1 contains a heap-based out-of-bounds read vulnerability in CSoundFile::ReadAMS2() in src/load_ams.cpp that allows... | 2026-10-16 |