Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120448 | high | 8.1 | No | DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that allows authenticated low-p... | 2026-11-02 |
| CVE-2026-120445 | high | 8.8 | No | madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows authenticated tenant... | 2026-11-02 |
| CVE-2026-120444 | high | 8.1 | No | GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary directories by suppl... | 2026-11-02 |
| CVE-2026-120441 | medium | 5.3 | No | OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows unauthenticated remote at... | 2026-11-02 |
| CVE-2026-120428 | medium | 6.1 | No | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to upload HTML fi... | 2026-11-02 |
| CVE-2026-120425 | medium | 6.5 | No | Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that allows authenticated u... | 2026-11-02 |
| CVE-2026-120318 | high | 7.2 | No | Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing authorization vulnerability in... | 2026-11-02 |
| CVE-2026-74993 | high | 7.5 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer and Network Systems I... | 2026-11-02 |
| CVE-2026-92886 | high | 7.8 | No | Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. Th... | 2026-11-02 |
| CVE-2026-107342 | medium | 4.3 | No | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability check when its test-email... | 2026-11-02 |
| CVE-2026-120249 | medium | 6.5 | No | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations... | 2026-11-02 |
| CVE-2026-120248 | medium | 4.8 | No | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store upd... | 2026-11-02 |
| CVE-2026-120209 | critical | 9.8 | No | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers c... | 2026-11-02 |
| CVE-2026-120205 | high | 8.0 | No | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attac... | 2026-11-02 |
| CVE-2026-120204 | medium | 5.6 | No | DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to cre... | 2026-11-02 |
| CVE-2026-120200 | medium | 5.4 | No | Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate... | 2026-11-02 |
| CVE-2026-63410 | medium | 5.9 | No | secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication thro... | 2026-11-02 |
| CVE-2026-63401 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUse... | 2026-11-02 |
| CVE-2026-63398 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated... | 2026-11-02 |
| CVE-2026-63396 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/a... | 2026-11-02 |