Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111142 | medium | 5.5 | No | Zziplib through 0.13.80 contains an out-of-bounds read vulnerability in zzip/mmapped.c that allows attackers to over-read heap memory via a... | 2026-10-16 |
| CVE-2026-111132 | medium | 6.1 | No | GNOME libgxps through 0.3.2 contains a heap out-of-bounds read in path_geometry_start_element() that allows attackers to read past allocatio... | 2026-10-16 |
| CVE-2026-110888 | medium | 4.3 | No | Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels... | 2026-10-16 |
| CVE-2026-110873 | high | 7.1 | No | Heym from 0.0.55 before 0.0.121 contains a privilege escalation vulnerability that allows shared collaborators to overwrite a workflow's err... | 2026-10-16 |
| CVE-2026-110868 | high | 8.5 | No | Renovate before 44.79.0 contains a server-side request forgery vulnerability that allows users to make the shared HTTP client request arbitr... | 2026-10-16 |
| CVE-2026-110863 | high | 8.1 | No | Better Auth @better-auth/sso from 1.7.0-rc.2 before 1.7.3 contains an authentication bypass vulnerability that allows authenticated users to... | 2026-10-16 |
| CVE-2026-110858 | high | 8.1 | No | GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only k... | 2026-10-16 |
| CVE-2026-110853 | not reported | — | No | n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying... | 2026-10-16 |
| CVE-2026-110848 | not reported | — | No | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a prototype pollution vulnerability in the AI workflow builder, wh... | 2026-10-16 |
| CVE-2026-110843 | not reported | — | No | n8n before 2.41.4 and 2.42.x before 2.42.1 contains an uncontrolled resource consumption vulnerability in the unauthenticated OAuth authoriz... | 2026-10-16 |
| CVE-2026-110775 | medium | 6.5 | No | Nexent through 2.7.0 contains a missing authorization vulnerability in check_file_access that allows authenticated users to read other tenan... | 2026-10-16 |
| CVE-2026-110381 | medium | 6.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows... | 2026-10-16 |
| CVE-2026-110628 | high | 8.6 | No | Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to... | 2026-10-16 |
| CVE-2026-110623 | high | 7.5 | No | Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to shar... | 2026-10-16 |
| CVE-2026-110375 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-mon... | 2026-10-16 |
| CVE-2026-109893 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-... | 2026-10-16 |
| CVE-2026-109221 | high | 8.1 | No | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to arbitrary file deletion due to insufficien... | 2026-10-16 |
| CVE-2026-109160 | medium | 4.3 | No | A vulnerability was determined in PublicCMS up to 5.202608.a. Affected by this issue is the function SafeConfigComponent.getSafeUrl of the f... | 2026-10-16 |
| CVE-2026-109153 | medium | 6.3 | No | A vulnerability was detected in MosaicML Composer up to 0.32.1. This affects the function tarball.extractall of the file composer/utils/chec... | 2026-10-16 |
| CVE-2026-109143 | medium | 5.4 | No | A vulnerability was determined in calcom cal.com and cal.diy up to 6.2.0. This vulnerability affects the function credentials.delete of the... | 2026-10-16 |