Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109292 | medium | 6.8 | No | Open WebUI from 0.6.27 before 0.11.4 contains an information disclosure vulnerability that allows destination servers to obtain user session... | 2026-10-15 |
| CVE-2026-109285 | medium | 5.0 | No | Open WebUI from 0.6.0 before 0.11.4 contains an improper access control vulnerability in has_access_to_file that lets former knowledge base... | 2026-10-15 |
| CVE-2026-108651 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the getRolesByUserId handler of SystemApiController that allows au... | 2026-10-15 |
| CVE-2026-108646 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCategoryController importExcel handler that allows any auth... | 2026-10-15 |
| CVE-2026-108641 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' in-a... | 2026-10-15 |
| CVE-2026-108636 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any aut... | 2026-10-15 |
| CVE-2026-108626 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privile... | 2026-10-15 |
| CVE-2026-108621 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticat... | 2026-10-15 |
| CVE-2026-108616 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any aut... | 2026-10-15 |
| CVE-2026-108611 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any auth... | 2026-10-15 |
| CVE-2026-108606 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticat... | 2026-10-15 |
| CVE-2026-107171 | not reported | — | No | An Hardcoded Cryptographic Key vulnerability existed in Trellix Agent 5.8.4 via mfecryptc.dll leads to Database Decryption by Regular Users. | 2026-10-15 |
| CVE-2026-105107 | high | 7.6 | No | Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates t... | 2026-10-15 |
| CVE-2026-105106 | high | 8.8 | No | Koha is vulnerable to OS command injection in the Task Scheduler deletion path. The tools/scheduler.pl handler accepts the jobid request par... | 2026-10-15 |
| CVE-2026-110466 | medium | 4.3 | No | Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading... | 2026-10-15 |
| CVE-2026-110465 | medium | 4.3 | No | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specif... | 2026-10-15 |
| CVE-2026-94370 | not reported | — | No | A defect in the Qt for MCUs core string handling causes heap memory corruption. When an application passes text into Qt Quick Ultralite usin... | 2026-10-15 |
| CVE-2026-108473 | not reported | — | No | Multiple Kasa devices contain an improper authentication vulnerability in the local device-management protocol. An unauthenticated adjacent... | 2026-10-15 |
| CVE-2026-63156 | medium | 6.1 | No | Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inje... | 2026-10-15 |
| CVE-2026-63163 | high | 7.5 | No | Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenti... | 2026-10-15 |