Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93678 | high | 7.6 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper authorizat... | 2026-10-09 |
| CVE-2026-93448 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation... | 2026-10-09 |
| CVE-2026-76061 | medium | 5.5 | No | A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or loc... | 2026-10-09 |
| CVE-2026-75962 | high | 7.2 | No | The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vu... | 2026-10-09 |
| CVE-2026-63692 | critical | 10.0 | No | Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authentication for Critical Function vulnerability. An unauth... | 2026-10-09 |
| CVE-2026-15688 | not reported | — | No | Incorrect Implementation of Authentication Algorithm Vulnerability in Mitsubishi Electric GX Works3 and Motion Control Setting allows a loca... | 2026-10-09 |
| CVE-2026-106450 | medium | 5.3 | No | yawkat LZ4 Java provides LZ4 compression for Java. Prior to 1.11.4, net.jpountz.lz4.LZ4FrameInputStream readHeader() allocates two new 4 MiB... | 2026-10-09 |
| CVE-2026-106440 | high | 7.8 | No | Hydra is a framework for elegantly configuring complex applications. From 1.2.0 until 1.3.0 and 1.4.0.dev10, the hydra-optuna-sweeper packag... | 2026-10-09 |
| CVE-2026-106221 | high | 8.3 | No | Confused deputy in WebAPKs in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to... | 2026-10-09 |
| CVE-2026-106199 | high | 8.2 | No | Incorrect authorization in Actor in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the ren... | 2026-10-09 |
| CVE-2026-106120 | not reported | — | No | LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, enabling ownPropertyOnly does not cons... | 2026-10-09 |
| CVE-2026-106104 | not reported | — | No | Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.23.3, Platform.parseSSR() passed an unbound... | 2026-10-09 |
| CVE-2026-106038 | high | 8.2 | No | Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-de... | 2026-10-09 |
| CVE-2026-105957 | medium | 6.3 | No | A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /op... | 2026-10-09 |
| CVE-2026-105920 | high | 7.3 | No | A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted eleme... | 2026-10-09 |
| CVE-2026-105844 | not reported | — | No | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-... | 2026-10-09 |
| CVE-2026-105801 | not reported | — | No | openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious O... | 2026-10-09 |
| CVE-2026-105840 | high | 7.5 | No | lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM sender... | 2026-10-09 |
| CVE-2026-105835 | high | 7.4 | No | PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute... | 2026-10-09 |
| CVE-2026-105808 | low | 3.5 | No | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the... | 2026-10-09 |