Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55271 | high | 8.4 | No | In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This c... | 2026-11-03 |
| CVE-2026-55262 | high | 8.4 | No | In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due... | 2026-11-03 |
| CVE-2026-55257 | high | 8.4 | No | In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local... | 2026-11-03 |
| CVE-2026-88094 | high | 8.1 | No | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an author... | 2026-11-03 |
| CVE-2026-78162 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 bef... | 2026-11-03 |
| CVE-2026-119573 | low | 3.0 | No | Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the cross-namespace check... | 2026-11-03 |
| CVE-2026-73697 | high | 8.8 | No | Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection vulnerability in the phpini_e... | 2026-11-03 |
| CVE-2026-73695 | high | 8.8 | No | Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in services/users/index.php that allows attacke... | 2026-11-03 |
| CVE-2026-75520 | medium | 5.4 | No | Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON com... | 2026-11-03 |
| CVE-2026-51903 | high | 8.1 | No | SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.... | 2026-11-03 |
| CVE-2026-61564 | critical | 10.0 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `video... | 2026-11-03 |
| CVE-2026-54453 | high | 7.2 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, th... | 2026-11-03 |
| CVE-2026-61542 | high | 8.6 | No | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected compon... | 2026-11-03 |
| CVE-2026-57199 | not reported | — | No | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified... | 2026-11-03 |
| CVE-2026-119843 | medium | 6.5 | No | A flaw was found in GStreamer's gst-plugins-good package. The FLV media demuxer does not properly validate buffer sizes and data availabilit... | 2026-11-03 |
| CVE-2026-120578 | medium | 5.3 | No | The AI Alt Text Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.0. This is du... | 2026-11-03 |
| CVE-2026-120561 | medium | 5.3 | No | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing ca... | 2026-11-03 |
| CVE-2026-120544 | medium | 4.3 | No | The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all vers... | 2026-11-03 |
| CVE-2026-118803 | high | 7.5 | No | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to contro... | 2026-11-03 |
| CVE-2026-118754 | medium | 5.3 | No | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthentica... | 2026-11-03 |