Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107914 | high | 7.8 | No | Backdrop CMS 1.34 before 1.34.5 and 1.35 before 1.35.1 doesn't sufficiently protect configuration exports when delivering a compressed archi... | 2026-10-14 |
| CVE-2026-107738 | not reported | — | No | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, ChmFile::GetCharZ() narrows file-controlled unsigned string offsets f... | 2026-10-14 |
| CVE-2026-107733 | not reported | — | No | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, FrameOnCommand() handles CmdExec by passing a null current-tab pointe... | 2026-10-14 |
| CVE-2026-107801 | medium | 5.4 | No | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploa... | 2026-10-14 |
| CVE-2026-107796 | medium | 6.1 | No | Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThr... | 2026-10-14 |
| CVE-2026-107782 | high | 7.8 | No | System Informer before 4.0.26241.138 contains an incorrect authorization vulnerability in the phsvc helper that allows local attackers to re... | 2026-10-14 |
| CVE-2026-107728 | high | 7.5 | No | Strawberry GraphQL is a library for creating GraphQL APIs. From 0.217.0 until 0.326.1, PermissionExtension.resolve() on a synchronous field... | 2026-10-14 |
| CVE-2026-107651 | medium | 5.5 | No | A flaw was found in Eye of GNOME (eog). A heap-based buffer overflow exists in the PNG metadata reader due to improper state handling when p... | 2026-10-14 |
| CVE-2026-107723 | high | 8.1 | No | fast-jwt provides fast JSON Web Token (JWT) implementation. Prior to 6.3.0, fast-jwt createVerifier accepts a validly signed JWT whose paylo... | 2026-10-14 |
| CVE-2026-107718 | medium | 6.1 | No | AdonisJS HTTP Server is a package for handling HTTP requests in the AdonisJS framework. Prior to 8.2.3 and 9.3.0, AdonisJS HTTP Server inser... | 2026-10-14 |
| CVE-2026-107399 | medium | 6.8 | No | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize applies no origin trust boundary in Mecha... | 2026-10-14 |
| CVE-2026-107708 | medium | 4.9 | No | MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while... | 2026-10-14 |
| CVE-2026-107699 | critical | 9.8 | No | ppt2png through 0.0.6 contains an OS command injection vulnerability that allows attackers to execute operating system commands by supplying... | 2026-10-14 |
| CVE-2026-104079 | medium | 4.3 | No | Envira Gallery Lite before 1.16.2 contains a missing authorization vulnerability in its gallery conversion REST endpoint that allows lower-p... | 2026-10-14 |
| CVE-2026-107393 | medium | 6.1 | No | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unval... | 2026-10-14 |
| CVE-2026-107383 | high | 7.5 | No | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. Prior to 3.2.5, 3.3.4, 3.4.7,... | 2026-10-14 |
| CVE-2026-107377 | high | 7.5 | No | datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.81.0, an attacker-controlled Protobuf sch... | 2026-10-14 |
| CVE-2026-104075 | critical | 9.8 | No | TVU Networks Receiver/Transceiver devices running firmware before version 7.9 contain an authentication bypass vulnerability in the web mana... | 2026-10-14 |
| CVE-2026-97147 | not reported | — | No | In OpenStack Mistral through 23.0.0, several of the v2 API write paths resolve the target object with a query that can return another projec... | 2026-10-14 |
| CVE-2026-107301 | medium | 6.5 | No | msgpack5 is a msgpack v5 implementation for node.js and the browser. Prior to 6.1.0, constructing msgpack5 with an empty or partial options... | 2026-10-14 |