Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120249 | medium | 6.5 | No | Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the /admin/product/combinations... | 2026-11-02 |
| CVE-2026-120248 | medium | 4.8 | No | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store upd... | 2026-11-02 |
| CVE-2026-120209 | critical | 9.8 | No | AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens offline. Attackers c... | 2026-11-02 |
| CVE-2026-120205 | high | 8.0 | No | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attac... | 2026-11-02 |
| CVE-2026-120204 | medium | 5.6 | No | DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows remote attackers to cre... | 2026-11-02 |
| CVE-2026-120200 | medium | 5.4 | No | Nexterm through 1.2.2-BETA contains a missing authorization vulnerability that allows authenticated users to hibernate, resume, or terminate... | 2026-11-02 |
| CVE-2026-63410 | medium | 5.9 | No | secp256k1-native is a native C secp256k1 implementation for Ruby. In affected native builds, native constant-time scalar multiplication thro... | 2026-11-02 |
| CVE-2026-63401 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, `addAccessibleQueuesForUser` and `removeAccessibleQueuesForUse... | 2026-11-02 |
| CVE-2026-63398 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.2, the SAML strategy's verify callback resolved the authenticated... | 2026-11-02 |
| CVE-2026-63396 | not reported | — | No | Coop is an open source review and moderation tool from ROOST. Prior to 1.0.0, an unauthenticated actor can query `Query.allOrgs` through `/a... | 2026-11-02 |
| CVE-2026-63378 | high | 8.8 | No | TAKO AI Agent for Okta is a local-first AI agent that helps Okta administrators query tenant data using natural language. Prior to 3.0.1-bet... | 2026-11-02 |
| CVE-2026-63346 | not reported | — | No | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, the header parameter name in `parameters[].n... | 2026-11-02 |
| CVE-2026-63345 | not reported | — | No | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.2, OpenAPI `paths`-object keys are emitted verb... | 2026-11-02 |
| CVE-2026-61725 | medium | 6.1 | No | sevenz-rust2 is a Rust-native 7z compressor and `decompress`or. Prior to 0.21.1, extracting an attacker-supplied 7z archive can write or ove... | 2026-11-02 |
| CVE-2026-63201 | not reported | — | No | Netopeer2 is a server for implementing network configuration management based on the `NETCONF` Protocol. In affected versions, a low-privile... | 2026-11-02 |
| CVE-2026-63184 | high | 7.1 | No | Refitter is a tool for generating a C# REST API client using the Refit library. Prior to 2.1.1, the `refitter` dotnet tool invokes `NJsonSch... | 2026-11-02 |
| CVE-2026-62277 | medium | 6.5 | No | LubeLogger is a self-hosted, open-source, web-based vehicle maintenance and fuel mileage tracker. Prior to 1.6.8, `PrintRecordStickers` in `... | 2026-11-02 |
| CVE-2026-55612 | low | 3.7 | No | uhttpd is a small HTTP server. In unpatched repository snapshots, `client_poll_post_data()` in `client.c` consumes an invalid chunk-length l... | 2026-11-02 |
| CVE-2026-55147 | medium | 6.3 | No | LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neur... | 2026-11-02 |
| CVE-2026-62979 | not reported | — | No | jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializ... | 2026-11-02 |