Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-117028 | medium | 6.5 | No | Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method. An... | 2026-11-03 |
| CVE-2026-118673 | not reported | — | No | KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC brow... | 2026-11-03 |
| CVE-2026-118079 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Object Injection.Th... | 2026-11-03 |
| CVE-2026-118691 | low | 3.7 | No | xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenti... | 2026-11-03 |
| CVE-2026-116827 | medium | 6.8 | No | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in the Bazar CSV import copyUrlToLocalFile() function that allows... | 2026-11-03 |
| CVE-2026-116823 | medium | 6.1 | No | YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by s... | 2026-11-03 |
| CVE-2026-116208 | high | 8.1 | No | YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious Act... | 2026-11-03 |
| CVE-2026-116204 | high | 8.1 | No | YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets... | 2026-11-03 |
| CVE-2026-116016 | high | 7.1 | No | yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade row-level data scope res... | 2026-11-03 |
| CVE-2026-110200 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due to cleartext storage o... | 2026-11-03 |
| CVE-2026-105949 | high | 8.8 | No | Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all wildcard constraint... | 2026-11-03 |
| CVE-2026-105312 | critical | 9.9 | No | A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag... | 2026-11-03 |
| CVE-2026-105311 | high | 7.7 | No | The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s... | 2026-11-03 |
| CVE-2026-102710 | not reported | — | No | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, built with TX_ENABLE_EVENT_TRACE, the Module Manager lets a user-mode, memory-protec... | 2026-11-03 |
| CVE-2026-102709 | not reported | — | No | In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the four non-secure-callable secure stack functions of the TrustZone-M ports derefer... | 2026-11-03 |
| CVE-2023-54413 | medium | 6.1 | No | WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated... | 2026-11-03 |
| CVE-2022-51022 | critical | 9.1 | No | YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFil... | 2026-11-03 |
| CVE-2011-4899 | high | 7.5 | No | wp-admin/setup-config.php in the installation component in WordPress 3.3.1 and earlier does not ensure that the specified MySQL database ser... | 2026-11-03 |
| CVE-2026-87399 | medium | 6.3 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). The supported version that is... | 2026-11-03 |
| CVE-2026-87390 | medium | 5.4 | No | Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). Supported versions that are a... | 2026-11-03 |