Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110222 | medium | 5.3 | No | Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by... | 2026-10-14 |
| CVE-2026-110217 | medium | 6.5 | No | Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to retrieve other opera... | 2026-10-14 |
| CVE-2026-110212 | medium | 4.3 | No | Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write uploaded files outsi... | 2026-10-14 |
| CVE-2026-110207 | high | 8.8 | No | Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, departme... | 2026-10-14 |
| CVE-2026-110130 | critical | 10.0 | No | Dockhand before 1.0.45 contains an authentication bypass in which the global auth hook skips authentication for any path ending in a static-... | 2026-10-14 |
| CVE-2026-108902 | high | 8.1 | No | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains a path traversal vulnerability in the picture module deletePhoto() action that all... | 2026-10-14 |
| CVE-2026-108885 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController delete handler that allows low-privileged... | 2026-10-14 |
| CVE-2026-108880 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the PUT /sys/dict/editDictByLowAppId endpoint that allows any auth... | 2026-10-14 |
| CVE-2026-108875 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any auth... | 2026-10-14 |
| CVE-2026-108870 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privile... | 2026-10-14 |
| CVE-2026-108774 | medium | 6.3 | No | A flaw has been found in erzhongxmu JEEWMS up to 2026.09.27-W39. The affected element is the function getbinall/getbinallagv of the file src... | 2026-10-14 |
| CVE-2026-108769 | medium | 4.3 | No | A security flaw has been discovered in zhayujie CowAgent up to 2.2.0. This affects an unknown part of the file Markdown.tsx of the component... | 2026-10-14 |
| CVE-2026-108682 | medium | 5.4 | No | A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the compon... | 2026-10-14 |
| CVE-2026-108755 | medium | 5.3 | No | Hatchet through 0.110.5 contains an allocation of resources without limits vulnerability that allows unauthenticated attackers to exhaust me... | 2026-10-14 |
| CVE-2026-108577 | medium | 4.3 | No | A vulnerability was determined in Konstanty Bialkowski libmodplug up to 0.8.9.1. This issue affects the function abc_add_gchord of the file... | 2026-10-14 |
| CVE-2026-108104 | medium | 4.8 | No | Xerial snappy-java from 1.1.7.4 before 1.1.10.10 contains a double release vulnerability in SnappyFramedInputStream that returns pooled buff... | 2026-10-14 |
| CVE-2026-108100 | medium | 6.5 | No | HortusFox (hortusfox-web) before 6.2 contains an SQL injection vulnerability that allows API token holders to inject SQL by supplying crafte... | 2026-10-14 |
| CVE-2026-107829 | medium | 5.9 | No | Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash... | 2026-10-14 |
| CVE-2026-107798 | medium | 5.4 | No | jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle... | 2026-10-14 |
| CVE-2026-107779 | critical | 9.8 | No | Dromara Skyeye through commit 003549ae5615bd114ba5bb8ddf6a8e8ead97c321 contains a missing authentication vulnerability in bundled xxl-job-ad... | 2026-10-14 |