Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-39375 | not reported | — | No | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.0, an authentic... | 2026-10-30 |
| CVE-2026-119298 | medium | 4.2 | No | croc is a tool that allows any two computers to simply and securely transfer files and folders. Prior to 11.5.2, the receive-side file-readi... | 2026-10-30 |
| CVE-2026-61737 | critical | 9.8 | No | ng-antd-admin is an Angular and NestJS administration system template. Prior to 22.0, a hardcoded default `JWT` secret permits token forgery... | 2026-10-30 |
| CVE-2026-61627 | not reported | — | No | libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle format. Prior to 0.17.5, liba... | 2026-10-30 |
| CVE-2026-86715 | high | 7.1 | No | Plaintext storage of a password vulnerability in Crypttech Crypto and Informatics Technologies Industry and Trade Inc. Vatos DLP allows Use... | 2026-10-30 |
| CVE-2026-22114 | not reported | — | No | HTTP basic auth enforces no retry limit or backoff. Combined with the default service password, the keyspace is exhaustible. | 2026-10-30 |
| CVE-2026-22110 | not reported | — | No | The web server does not check authentication on POST or PUT. An unauthenticated attacker can reboot the charger; by brute-forcing the config... | 2026-10-30 |
| CVE-2026-22109 | not reported | — | No | The shipped WebUI template database retains the factory default passwords for all five account types in cleartext. Defaults are identical ac... | 2026-10-30 |
| CVE-2026-22105 | not reported | — | No | Delta UFC500 charging stations derive the default credentials of the Service account from character positions of the device serial number. A... | 2026-10-30 |
| CVE-2026-97209 | not reported | — | No | Insecure Temporary File vulnerability in Mix deps.partition in Elixir allows a local user to execute code as another user via a swapped part... | 2026-10-30 |
| CVE-2026-115274 | not reported | — | No | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's JSON module allows an unauthenticated atta... | 2026-10-30 |
| CVE-2026-109821 | not reported | — | No | Improper Validation of Specified Quantity in Input vulnerability in the Elixir standard library's URI module allows an attacker who supplies... | 2026-10-30 |
| CVE-2026-92744 | not reported | — | No | Under certain conditions, privilege manager agent allows a remote unauthenticated attacker to execute arbitrary code as LocalSystem. | 2026-10-30 |
| CVE-2026-61645 | critical | 9.1 | No | Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vulnerability in the `U... | 2026-10-30 |
| CVE-2026-51905 | high | 8.8 | No | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/a... | 2026-10-30 |
| CVE-2026-11587 | high | 7.2 | No | SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database | 2026-10-30 |
| CVE-2026-118763 | high | 7.4 | No | sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a Re... | 2026-10-30 |
| CVE-2026-107058 | critical | 9.8 | No | An issue in Shelter versionCode 445 allows attackers to register their own auth_key and execute a takeover of another user's binder service... | 2026-10-30 |
| CVE-2026-107055 | high | 7.5 | No | Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary file... | 2026-10-30 |
| CVE-2026-107052 | high | 7.5 | No | Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily r... | 2026-10-30 |