Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54454 | critical | 9.1 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to 0.10.0, the OpenCA... | 2026-10-13 |
| CVE-2026-106504 | medium | 6.5 | No | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected... | 2026-10-13 |
| CVE-2026-100757 | high | 8.8 | No | Use-after-free in the Widget component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thunderbird... | 2026-10-13 |
| CVE-2026-100758 | critical | 9.6 | No | Sandbox escape in the DOM: Navigation component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Thu... | 2026-10-13 |
| CVE-2026-100759 | high | 8.1 | No | Uninitialized memory in the Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbir... | 2026-10-13 |
| CVE-2026-100760 | critical | 9.6 | No | Sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbir... | 2026-10-13 |
| CVE-2026-108888 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any auth... | 2026-10-13 |
| CVE-2026-108883 | medium | 6.5 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user... | 2026-10-13 |
| CVE-2026-108878 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController queryById handler that allows low-privilege... | 2026-10-13 |
| CVE-2026-108873 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any departme... | 2026-10-13 |
| CVE-2026-108868 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announ... | 2026-10-13 |
| CVE-2026-108679 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows... | 2026-10-13 |
| CVE-2026-108676 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows lo... | 2026-10-13 |
| CVE-2026-108671 | medium | 6.5 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to read MCP server configurations... | 2026-10-13 |
| CVE-2026-108669 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the embeddingSearch handler of AiragKnowledgeController that lacks... | 2026-10-13 |
| CVE-2026-108666 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the deleteBatch handler of AiragPromptsController that allows any... | 2026-10-13 |
| CVE-2026-108664 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController queryById handler that allows low-privi... | 2026-10-13 |
| CVE-2026-108661 | medium | 6.5 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to transfer tenant ownership via P... | 2026-10-13 |
| CVE-2026-108659 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController listPackByTenantUserId handler that allows... | 2026-10-13 |
| CVE-2026-108656 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController GET /sys/tenant/getTenantPackApplyUsers en... | 2026-10-13 |