Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109202 | medium | 6.5 | No | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated... | 2026-10-13 |
| CVE-2026-109201 | high | 8.3 | No | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authen... | 2026-10-13 |
| CVE-2026-109170 | medium | 6.5 | No | LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to... | 2026-10-13 |
| CVE-2026-109169 | medium | 6.5 | No | LogicalDOC Community Edition through 9.3 contains a sql injection vulnerability that allows authenticated users to execute crafted SQL via t... | 2026-10-13 |
| CVE-2026-109175 | medium | 4.3 | No | MoguBlog through 6.2 contains an insecure direct object reference vulnerability that allows authenticated administrators to list other admin... | 2026-10-13 |
| CVE-2026-109174 | medium | 6.5 | No | MoguBlog through 6.2 contains an information disclosure vulnerability that allows low-privileged front-end users to read system credentials... | 2026-10-13 |
| CVE-2026-108887 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authent... | 2026-10-13 |
| CVE-2026-108882 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController removeUserPosition handler that allows a... | 2026-10-13 |
| CVE-2026-108877 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in AiragPromptsController that allows any authenticated user to delet... | 2026-10-13 |
| CVE-2026-108872 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any au... | 2026-10-13 |
| CVE-2026-108867 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any... | 2026-10-13 |
| CVE-2026-74043 | critical | 9.0 | No | Wazuh from 4.1.1 before 4.14.8 contains a path traversal vulnerability in upload_list_file, upload_rule_file, and upload_decoder_file that a... | 2026-10-13 |
| CVE-2026-74035 | high | 7.2 | No | Wazuh versions from 4.6.0 before 4.14.8 contain an authentication bypass vulnerability where security.update_user places the reserved user g... | 2026-10-13 |
| CVE-2026-74030 | medium | 4.9 | No | Wazuh from 3.9.0 before 4.14.8 contains an uncontrolled YAML alias expansion vulnerability in yaml2json_node that allows a manager-controlle... | 2026-10-13 |
| CVE-2026-109954 | medium | 6.5 | No | Parse Server 5.4.0 before 8.6.96 and 9.0.0 before 9.10.2-alpha.5 shares transactional batch state across concurrent requests, letting any cl... | 2026-10-13 |
| CVE-2026-109572 | high | 7.6 | No | Open WebUI from 0.8.6 before 0.11.4 contains a privilege escalation vulnerability in the terminal proxy that allows authenticated users to r... | 2026-10-13 |
| CVE-2026-109303 | medium | 4.3 | No | Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 does not enforce identity-scoped protectedFields (authenticated, role, or per-us... | 2026-10-13 |
| CVE-2026-109293 | medium | 6.5 | No | Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool ex... | 2026-10-13 |
| CVE-2026-109289 | medium | 6.3 | No | Open WebUI from 0.8.8 before 0.11.4 contains an improper authorization vulnerability that allows deactivated users to keep executing termina... | 2026-10-13 |
| CVE-2026-109288 | medium | 6.4 | No | Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link UR... | 2026-10-13 |