Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95616 | high | 7.5 | No | An integer overflow in WSS4J's DER bounds check lets an oversized allocation pass validation. An unauthenticated attacker can send a SOAP me... | 2026-10-06 |
| CVE-2026-76570 | critical | 9.1 | No | Joomla Extension - joomcode.com - Unauthenticated SQL injection in read and write queries in JCTables 1.21.1 - The front-end CRUD API contro... | 2026-10-06 |
| CVE-2026-88424 | critical | 9.8 | No | FineAdmin v1.0 was discovered to contain a SQL injection vulnerability via the field/order parameter at ButtonService.GetListByFilter(). Thi... | 2026-10-06 |
| CVE-2026-82043 | medium | 5.3 | No | UTMStack before 11.2.16 contains an account enumeration vulnerability that allows unauthenticated attackers to determine registered email ad... | 2026-10-06 |
| CVE-2026-94543 | medium | 5.3 | No | Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, self-hosted applications using... | 2026-10-06 |
| CVE-2026-94483 | medium | 6.5 | No | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, Image Optimization can follow attacker-cont... | 2026-10-06 |
| CVE-2026-78861 | high | 7.7 | No | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via a hardcoded 512-bit RSA Private Key | 2026-10-06 |
| CVE-2026-71298 | medium | 6.4 | No | A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API... | 2026-10-06 |
| CVE-2026-106037 | critical | 9.8 | No | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the Store REST service, which binds to 0.0.0.0 without auth... | 2026-10-06 |
| CVE-2026-105839 | high | 7.8 | No | libmikmod before 3.3.14 contains an integer overflow in the Oktalyzer loader OKT_doPBOD() that allows attackers to cause heap buffer overflo... | 2026-10-06 |
| CVE-2026-105834 | medium | 6.5 | No | Rundeck before 6.2.0 contains a path traversal vulnerability that allows users holding only the project configure ACL to read arbitrary serv... | 2026-10-06 |
| CVE-2026-105701 | high | 8.8 | No | The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render f... | 2026-10-06 |
| CVE-2026-105741 | high | 7.1 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the... | 2026-10-06 |
| CVE-2026-105696 | medium | 6.5 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-page RPC accepts a share-link permission object with blan... | 2026-10-06 |
| CVE-2026-105691 | critical | 9.9 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the SVG exporter places an attacker-controlled text object's fill... | 2026-10-06 |
| CVE-2026-105686 | not reported | — | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the chunked media upload RPC validates that a chunk index is in r... | 2026-10-06 |
| CVE-2026-105680 | medium | 6.5 | No | Ghost is a Node.js content management system. From 5.81.0 until 6.60.0, staff with the Author role could delete posts and pages that they di... | 2026-10-06 |
| CVE-2026-105675 | high | 7.5 | No | Ghost is a Node.js content management system. From 4.39.0 until 6.64.0, staff users with permission to view staff invites were able to disco... | 2026-10-06 |
| CVE-2026-105648 | medium | 4.0 | No | Ghost is a Node.js content management system. From 6.0.9 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, t... | 2026-10-06 |
| CVE-2026-105469 | high | 7.3 | No | A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This vulnera... | 2026-10-06 |