Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97689 | high | 7.5 | No | urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can all... | 2026-10-13 |
| CVE-2026-96236 | high | 7.5 | No | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | 2026-10-13 |
| CVE-2026-96204 | medium | 6.5 | No | Server-side request forgery (ssrf) in Azure Arc allows an authorized attacker to elevate privileges over a network. | 2026-10-13 |
| CVE-2026-96188 | high | 7.3 | No | External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally. | 2026-10-13 |
| CVE-2026-92088 | not reported | — | No | Improper handling of undefined values vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Escalation. Th... | 2026-10-13 |
| CVE-2026-110255 | high | 8.5 | No | Finsys Dockhand before 1.0.43 contains a response-disclosing server-side request forgery vulnerability that allows authenticated users to ma... | 2026-10-13 |
| CVE-2026-110240 | medium | 4.8 | No | Lancet through 2.3.9 contains an SSRF protection bypass vulnerability in netutil.IsInternalIP that misclassifies IPv6 private, link-local, C... | 2026-10-13 |
| CVE-2026-110235 | medium | 5.5 | No | MP Manager through 1.1.0 contains a path traversal vulnerability that allows attackers to write files outside the extraction folder by bypas... | 2026-10-13 |
| CVE-2026-110230 | medium | 5.4 | No | XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share c... | 2026-10-13 |
| CVE-2026-110224 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in AdminSearchConfController::processSave() that echoes reject... | 2026-10-13 |
| CVE-2026-110219 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject scripts through the pri... | 2026-10-13 |
| CVE-2026-110214 | low | 3.7 | No | Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download signatures for the /dev/fil... | 2026-10-13 |
| CVE-2026-110209 | medium | 6.5 | No | Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stor... | 2026-10-13 |
| CVE-2026-108905 | high | 7.5 | No | pH7Builder (pH7 Social Dating CMS) before 18.6.0 contains a hard-coded API key vulnerability in Tool.class.php that allows unauthenticated a... | 2026-10-13 |
| CVE-2026-108791 | medium | 4.3 | No | A weakness has been identified in westboy CicadasCMS up to 2431154dac8d0735e04f1fd2a3c3556668fc8dab. Affected is the function TemplateContro... | 2026-10-13 |
| CVE-2026-108787 | medium | 6.3 | No | A vulnerability was found in houtini-ai voice-analyser-mcp up to 2.1.1. The affected element is the function fetch of the file src/utils/cra... | 2026-10-13 |
| CVE-2026-108783 | high | 7.3 | No | A security vulnerability has been detected in PRVTPRO Amnezia-Web-Panel up to 1.6.2/1.7.2. This affects an unknown part of the file app.py o... | 2026-10-13 |
| CVE-2026-108778 | medium | 6.3 | No | A vulnerability was determined in erzhongxmu JEEWMS up to 2026.09.27-W39. This impacts the function WmInQmIController.list of the file src/m... | 2026-10-13 |
| CVE-2026-108773 | medium | 6.3 | No | A vulnerability was detected in erzhongxmu JEEWMS up to 2026.09.27-W39. Impacted is the function docheck of the file src/main/java/com/zzjee... | 2026-10-13 |
| CVE-2026-108768 | medium | 4.3 | No | A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streamin... | 2026-10-13 |