Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109667 | high | 8.8 | No | Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a privilege escalation vulnerability in a record-creation endpoint that take... | 2026-10-14 |
| CVE-2026-109662 | medium | 6.1 | No | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability in a public portal form that acc... | 2026-10-14 |
| CVE-2026-109657 | medium | 5.4 | No | Frappe ERPNext 16.x before 16.27.0 contains a stored cross-site scripting vulnerability that allows users with edit rights to inject script... | 2026-10-14 |
| CVE-2026-109652 | high | 8.8 | No | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a server-side template injection vulnerability because user-controlled messa... | 2026-10-14 |
| CVE-2026-109647 | medium | 6.5 | No | Frappe ERPNext before 15.106.0 and 16.x before 16.16.0 contains an SQL injection vulnerability in multiple endpoints caused by missing input... | 2026-10-14 |
| CVE-2026-109642 | medium | 4.3 | No | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-14 |
| CVE-2026-109637 | medium | 6.5 | No | Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond th... | 2026-10-14 |
| CVE-2026-109632 | medium | 6.5 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-14 |
| CVE-2026-109627 | medium | 6.5 | No | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-14 |
| CVE-2026-109622 | medium | 4.3 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-14 |
| CVE-2026-109609 | medium | 6.5 | No | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains an SQL injection vulnerability in some endpoints that lack input validation.... | 2026-10-14 |
| CVE-2026-109601 | medium | 6.5 | No | Frappe Framework before 15.117.0 and 16.x before 16.30.0 contains an arbitrary file read vulnerability in the handling of attributes in outg... | 2026-10-14 |
| CVE-2026-108940 | medium | 6.5 | No | A vulnerability was found in EricLBuehler Mistral.rs up to 0.9.3. The affected element is the function calibration_apply of the file mistral... | 2026-10-14 |
| CVE-2026-108936 | low | 2.4 | No | A security vulnerability has been detected in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formQoS of the compone... | 2026-10-14 |
| CVE-2022-2274 | critical | 9.8 | No | The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions. This is... | 2026-10-14 |
| CVE-2021-46848 | critical | 9.1 | No | GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der. | 2026-10-14 |
| CVE-2025-9661 | critical | 9.8 | No | OS command injection vulneravility in the management gui (maintenance utility) of Hitachi Virtual Storage Platform One Block 23, 24, 26 and... | 2026-10-14 |
| CVE-2025-13030 | critical | 9.8 | No | All versions of the package django-mdeditor are vulnerable to Missing Authentication for Critical Function in the image upload endpoint. An... | 2026-10-14 |
| CVE-2025-59947 | critical | 9.0 | No | NanoMQ is a messaging broker/bus for IoT Edge & SDV. Versions prior to 0.24.4 have a buffer overflow case while the PUBLISH packets trigger... | 2026-10-14 |
| CVE-2025-67906 | critical | 9.0 | No | In MISP before 2.5.28, app/View/Elements/Workflows/executionPath.ctp allows XSS in the workflow execution path. | 2026-10-14 |