Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108605 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticat... | 2026-10-14 |
| CVE-2026-108594 | low | 3.5 | No | Mealie 3.26.0 through 3.28.0 contains a server-side request forgery vulnerability in the OpenID Connect avatar fetch that ignores ports when... | 2026-10-14 |
| CVE-2026-108585 | medium | 5.4 | No | argocd-mcp (Argo CD MCP Server) through 0.9.0 contains a path traversal vulnerability in the delete_application tool that allows MCP clients... | 2026-10-14 |
| CVE-2026-108579 | medium | 4.2 | No | OpenPanel through 2.3.0 contains a CSV formula injection vulnerability that allows unauthenticated attackers to embed spreadsheet formulas b... | 2026-10-14 |
| CVE-2026-108545 | medium | 5.9 | No | SillyTavern 1.12.13 through 1.19.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust resour... | 2026-10-14 |
| CVE-2026-108158 | medium | 6.5 | No | plugNmeet Server through 2.5.2 contains a path traversal vulnerability in the whiteboard conversion endpoint that allows any meeting partici... | 2026-10-14 |
| CVE-2026-108112 | medium | 5.4 | No | ruoyi-ai 3.0.0 through 3.1.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' workflows... | 2026-10-14 |
| CVE-2026-106327 | medium | 6.1 | No | Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process t... | 2026-10-14 |
| CVE-2026-103367 | high | 8.1 | No | The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and includi... | 2026-10-14 |
| CVE-2026-102988 | medium | 5.3 | No | Plane is an open-source project management tool. Prior to 1.4.0, multiple issue-listing endpoints, including unauthenticated public deploy b... | 2026-10-14 |
| CVE-2026-104082 | high | 7.2 | No | SmarterMail before build 9777 contains a remote code execution vulnerability that allows an attacker holding a SysAdmin-scoped access token... | 2026-10-14 |
| CVE-2026-102402 | medium | 6.4 | No | The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta... | 2026-10-14 |
| CVE-2022-25235 | critical | 9.8 | No | xmltok_impl.c in Expat (aka libexpat) before 2.4.5 lacks certain validation of encoding, such as checks for whether a UTF-8 character is val... | 2026-10-14 |
| CVE-2022-23852 | critical | 9.8 | No | Expat (aka libexpat) before 2.4.4 has a signed integer overflow in XML_GetBuffer, for configurations with a nonzero XML_CONTEXT_BYTES. | 2026-10-14 |
| CVE-2022-23219 | critical | 9.8 | No | The deprecated compatibility function clnt_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its hostname arg... | 2026-10-14 |
| CVE-2022-23218 | critical | 9.8 | No | The deprecated compatibility function svcunix_create in the sunrpc module of the GNU C Library (aka glibc) through 2.34 copies its path argu... | 2026-10-14 |
| CVE-2022-22824 | critical | 9.8 | No | defineAttribute in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 2026-10-14 |
| CVE-2022-22823 | critical | 9.8 | No | build_model in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 2026-10-14 |
| CVE-2022-22822 | critical | 9.8 | No | addBinding in xmlparse.c in Expat (aka libexpat) before 2.4.3 has an integer overflow. | 2026-10-14 |
| CVE-2026-93347 | medium | 4.9 | No | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in the get_list_file helper that allows malicious cluster workers to... | 2026-10-14 |