Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107909 | critical | 9.1 | No | A heap-based out-of-bounds write in the ws_read_frame function (src/bolt/ws.c) and the buffer_apply_mask function (src/bolt/buffer.c) in Fal... | 2026-10-15 |
| CVE-2026-107908 | critical | 9.8 | No | A heap-based out-of-bounds write in the BoltReadHandler function (src/bolt/bolt_api.c) in FalkorDB before 4.20.0 allows a remote unauthentic... | 2026-10-15 |
| CVE-2026-105882 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-regi... | 2026-10-15 |
| CVE-2026-105067 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Webnus Modern Events Calendar Lite mod... | 2026-10-15 |
| CVE-2026-105674 | not reported | — | No | TP-Link Tapo C325WB V2 generates the pre-shared key used by its local media streaming service with a time-seeded pseudo-random number genera... | 2026-10-15 |
| CVE-2026-105672 | not reported | — | No | TP-Link Tapo C325WB V2 contains an unauthenticated authorization bypass vulnerability in the HTTPS JSON API dispatcher on TCP port 443. An a... | 2026-10-15 |
| CVE-2026-104110 | medium | 5.3 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.24.0, FileRise Pro /api/p... | 2026-10-15 |
| CVE-2026-104107 | medium | 6.5 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. In FileRise 3.22.0, the /api/file/sa... | 2026-10-15 |
| CVE-2026-104106 | medium | 6.5 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise permits an... | 2026-10-15 |
| CVE-2026-103988 | medium | 5.4 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise /api/folde... | 2026-10-15 |
| CVE-2026-104143 | not reported | — | No | DataEase is an open source data visualization and analysis tool. Prior to 2.10.26, authenticated users can store a crafted custom dateFormat... | 2026-10-15 |
| CVE-2026-104635 | not reported | — | No | Uncontrolled Recursion vulnerability in Protobuf.JSON.Decode in elixir-protobuf protobuf allows an unauthenticated remote attacker to crash... | 2026-10-15 |
| CVE-2026-102748 | not reported | — | No | Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 withou... | 2026-10-15 |
| CVE-2026-101926 | medium | 6.5 | No | The Hyyan WooCommerce Polylang Integration plugin for WordPress is vulnerable to SQL Injection via the 'variation_ids' parameter of the 'woo... | 2026-10-15 |
| CVE-2026-103425 | medium | 6.4 | No | The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and incl... | 2026-10-15 |
| CVE-2026-102501 | medium | 5.3 | No | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke... | 2026-10-15 |
| CVE-2026-103852 | medium | 5.5 | No | Substance3D - Stager is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attac... | 2026-10-15 |
| CVE-2026-101217 | medium | 6.5 | No | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Limitation of a Pathname to a Restricted Directory ('Path Trave... | 2026-10-15 |
| CVE-2026-100348 | medium | 5.3 | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3.Loader can dereference a nil SchemaRef.Value while resolv... | 2026-10-15 |
| CVE-2017-5674 | critical | 9.8 | No | A vulnerability in a custom-built GoAhead web server used on Foscam, Vstarcam, and multiple white-label IP camera models allows an attacker... | 2026-10-15 |