Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119655 | high | 7.5 | No | CoreShop through 1.5.5 contains an unauthenticated sql injection vulnerability in the api/Good/GetGoodsPageList endpoint via the unvalidated... | 2026-11-04 |
| CVE-2026-119651 | medium | 5.4 | No | HuLa-Server through 3.0.7 contains an insecure direct object reference vulnerability in FeedController.delFeed that allows authenticated use... | 2026-11-04 |
| CVE-2026-119647 | medium | 4.3 | No | RuoYi-Vue-Plus through 6.0.0 contains an authorization bypass vulnerability in SysUserServiceImpl.selectUserListByDept that allows authentic... | 2026-11-04 |
| CVE-2026-119600 | medium | 4.8 | No | tcpflow through 1.6.1 contains an out-of-bounds read vulnerability that allows unauthenticated attackers to read process memory by sending p... | 2026-11-04 |
| CVE-2026-119596 | medium | 4.3 | No | UNIT3D through 9.2.0 contains a missing authorization vulnerability in PlaylistZipController::show that allows authenticated users to downlo... | 2026-11-04 |
| CVE-2026-119575 | medium | 6.5 | No | ArcadeDB from 26.8.1 before 26.10.2 contains a server-side request forgery vulnerability that allows authenticated users with updateDatabase... | 2026-11-04 |
| CVE-2026-119571 | low | 3.7 | No | Parse Server from 9.7.0 before 9.10.5-alpha.10 contains an authorization flaw that applies _Installation updates addressed by object ID to t... | 2026-11-04 |
| CVE-2026-119591 | medium | 5.5 | No | SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process... | 2026-11-04 |
| CVE-2026-119566 | medium | 4.8 | No | Prometheus through 3.15.1 contains a credential leak vulnerability that allows attackers to capture Azure AD or Google IAM bearer tokens by... | 2026-11-04 |
| CVE-2026-119300 | medium | 6.5 | No | Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUse... | 2026-11-04 |
| CVE-2026-119291 | medium | 5.5 | No | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.4.0, @zuke/cli uses lstat to inspect scaffold names but th... | 2026-11-04 |
| CVE-2026-119562 | high | 8.8 | No | phpMyAdmin through 5.2.3 contains an sql injection vulnerability that allows authenticated users to inject SQL by supplying unescaped col_ex... | 2026-11-04 |
| CVE-2026-119558 | low | 3.1 | No | OpenCart through 4.1.0.4 contains a business logic vulnerability that allows logged-in customers to place unpaid full-price orders by cleari... | 2026-11-04 |
| CVE-2026-119554 | medium | 5.9 | No | Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contain an sql injection vulnerability in t... | 2026-11-04 |
| CVE-2026-119550 | low | 3.5 | No | Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to... | 2026-11-04 |
| CVE-2026-115770 | critical | 9.6 | No | Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerificat... | 2026-11-04 |
| CVE-2026-108387 | not reported | — | No | radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary... | 2026-11-04 |
| CVE-2026-102337 | not reported | — | No | Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or U... | 2026-11-04 |
| CVE-2026-119287 | high | 8.0 | No | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-for... | 2026-11-04 |
| CVE-2026-104064 | high | 7.8 | No | Scribus before 1.6.7 and 1.7.x before 1.7.4 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows a... | 2026-11-04 |