Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-60008 | low | 3.5 | No | Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization... | 2026-10-14 |
| CVE-2026-59766 | medium | 4.3 | No | Gitea's starred-repository and tracked-time API endpoints do not re-check current repository permissions before returning data associated wi... | 2026-10-14 |
| CVE-2026-25946 | medium | 5.3 | No | When OpenID sign-in is enabled, Gitea accepts a user-supplied OpenID URL and performs discovery requests without validating the destination... | 2026-10-14 |
| CVE-2026-110262 | low | 3.3 | No | OW2 ASM 3.1 before 9.11 contains an excessive memory allocation vulnerability in the asm-commons AdviceAdapter that allows attackers to exha... | 2026-10-14 |
| CVE-2026-110257 | medium | 5.5 | No | OW2 ASM 5.0 before 9.11 contains an excessive memory allocation vulnerability in ClassReader.readBootstrapMethodsAttribute() that sizes an i... | 2026-10-14 |
| CVE-2026-110254 | medium | 4.3 | No | Finsys Dockhand before 1.0.45 contains a server-side request forgery vulnerability in the ipCategory() function in src/lib/server/url-safety... | 2026-10-14 |
| CVE-2026-110239 | medium | 4.4 | No | Rapyd Admin before 9.20.0 contains a stored cross-site scripting vulnerability in the x-rpd::rich-text Blade component that outputs bound mo... | 2026-10-14 |
| CVE-2026-110234 | medium | 4.4 | No | Elio through 1.13.0 contains an insecure temporary file vulnerability that allows local users to overwrite another user's files by pre-creat... | 2026-10-14 |
| CVE-2026-110229 | medium | 5.4 | No | QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office empl... | 2026-10-14 |
| CVE-2026-110223 | low | 3.1 | No | Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to bypass the SSRF blockli... | 2026-10-14 |
| CVE-2026-110218 | low | 3.7 | No | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog... | 2026-10-14 |
| CVE-2026-110213 | medium | 4.3 | No | Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read ot... | 2026-10-14 |
| CVE-2026-110208 | high | 7.1 | No | Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated u... | 2026-10-14 |
| CVE-2026-110102 | high | 7.5 | No | Powerlevel10k through 1.20.0 contains an insecure download vulnerability in the gitstatus/install script that disables TLS certificate verif... | 2026-10-14 |
| CVE-2026-109901 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Codepeople CP Multi View Event Calenda... | 2026-10-14 |
| CVE-2026-110036 | low | 3.3 | No | A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to... | 2026-10-14 |
| CVE-2026-109890 | medium | 5.3 | No | Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Conf... | 2026-10-14 |
| CVE-2026-109620 | high | 7.3 | No | A vulnerability has been found in SourceCodester Online Reviewer System 1.0. Affected by this vulnerability is the function PDO::prepare of... | 2026-10-14 |
| CVE-2026-109743 | high | 8.8 | No | Privilege escalation in the Panning and Zooming component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158,... | 2026-10-14 |
| CVE-2026-109739 | high | 8.8 | No | Privilege escalation in the WebExtensions component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-14 |