Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121937 | low | 3.1 | No | loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any authenticated user to read ot... | 2026-11-04 |
| CVE-2026-121936 | medium | 6.5 | No | easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make the server send P... | 2026-11-04 |
| CVE-2026-121929 | low | 3.5 | No | A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.0. Impacted is an unknown function of the file /e/member/mspace/index.ph... | 2026-11-04 |
| CVE-2026-121928 | low | 3.5 | No | A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.2. This issue affects some unknown processing of the file api/utils/file_uti... | 2026-11-04 |
| CVE-2026-121733 | medium | 5.4 | No | Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the R... | 2026-11-04 |
| CVE-2026-121729 | high | 8.3 | No | emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes that allows any authen... | 2026-11-04 |
| CVE-2026-121640 | not reported | — | No | An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has observed a legitimate re... | 2026-11-04 |
| CVE-2026-121639 | not reported | — | No | A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote unauthenticated attacker with n... | 2026-11-04 |
| CVE-2026-121638 | not reported | — | No | An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path network position to inte... | 2026-11-04 |
| CVE-2026-121637 | not reported | — | No | An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a network attacker who... | 2026-11-04 |
| CVE-2026-121632 | not reported | — | No | Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping. process_attrs writes each... | 2026-11-04 |
| CVE-2026-121620 | medium | 6.5 | No | CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge Z... | 2026-11-04 |
| CVE-2026-121598 | critical | 9.9 | No | A security vulnerability has been detected in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This impacts the function strcpy of the file /cgi-bin/... | 2026-11-04 |
| CVE-2026-121373 | not reported | — | No | The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the refresh URL of content at... | 2026-11-04 |
| CVE-2026-121583 | medium | 6.3 | No | A vulnerability was identified in Sanluan PublicCMS 5. This affects the function TradePaymentService.pendingRefund of the file publiccms-par... | 2026-11-04 |
| CVE-2026-121535 | low | 3.7 | No | A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87. This vulnerability affects the function checkPassword of the file ap... | 2026-11-04 |
| CVE-2026-121542 | not reported | — | No | In Docker Buildx versions v0.19.0 through v0.38.0, an untrusted Bake definition may expose files accessible to the Buildx client without the... | 2026-11-04 |
| CVE-2026-121116 | medium | 5.3 | No | Missing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the ren... | 2026-11-04 |
| CVE-2026-119746 | medium | 5.9 | No | ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module web page. The account l... | 2026-11-04 |
| CVE-2026-119745 | medium | 4.3 | No | Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated user, including Subsc... | 2026-11-04 |