Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106808 | high | 7.5 | No | OpenAirInterface Core Network v2.2.1 has a stack-based buffer overflow vulnerability in the OAI CN5G UDM Nudm_UEAU Generate Authentication D... | 2026-11-02 |
| CVE-2026-120596 | high | 7.5 | No | A remotely exploitable denial-of-service vulnerability exists in the TCP options parser of the Nut/Net TCP/IP stack included in Nut/OS, deve... | 2026-11-02 |
| CVE-2026-106807 | not reported | — | No | A denial-of-service vulnerability exists in open5GS v2.8.0 in the PFCP transaction handling path. When the PFCP transaction or timer resourc... | 2026-11-02 |
| CVE-2026-120500 | medium | 6.1 | No | An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that allows attackers who... | 2026-11-02 |
| CVE-2026-109142 | high | 8.4 | No | When a CA's parent lives on the same Krill server: instead of building and verifying a signed CMS message, it runs the RFC 6492 provisioning... | 2026-11-02 |
| CVE-2026-109141 | high | 8.4 | No | The vulnerability gives a role that is restricted to a list of CAs (cas = [...]) its full permission set for every request that is not tied... | 2026-11-02 |
| CVE-2026-109140 | high | 8.4 | No | The vulnerability is that Krill encrypts every login-session token with a nonce built from a counter that is reset to 0 on every Krill resta... | 2026-11-02 |
| CVE-2026-120448 | high | 8.1 | No | DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-p... | 2026-11-02 |
| CVE-2026-120445 | high | 8.8 | No | madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant... | 2026-11-02 |
| CVE-2026-120444 | high | 8.1 | No | GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by suppl... | 2026-11-02 |
| CVE-2026-120441 | medium | 5.3 | No | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote at... | 2026-11-02 |
| CVE-2026-120428 | medium | 6.1 | No | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML fi... | 2026-11-02 |
| CVE-2026-120425 | medium | 6.5 | No | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated u... | 2026-11-02 |
| CVE-2026-120318 | high | 7.2 | No | Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in... | 2026-11-02 |
| CVE-2026-74993 | high | 7.5 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems I... | 2026-11-02 |
| CVE-2026-92886 | high | 7.8 | No | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. Th... | 2026-11-02 |
| CVE-2026-107342 | medium | 4.3 | No | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email... | 2026-11-02 |
| CVE-2026-120249 | medium | 6.5 | No | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations... | 2026-11-02 |
| CVE-2026-120248 | medium | 4.8 | No | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store upd... | 2026-11-02 |
| CVE-2026-120209 | critical | 9.8 | No | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers c... | 2026-11-02 |