Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109315 | medium | 6.5 | No | Grav from 2.0.22 before 2.1.7 contains an information disclosure vulnerability that allows page editors to read the Clockwork debugger token... | 2026-10-13 |
| CVE-2026-109392 | medium | 5.4 | No | Pimcore through 2026.3.1 contains a stored cross-site scripting vulnerability that allows authenticated backend users to inject scripts by s... | 2026-10-13 |
| CVE-2026-109310 | medium | 6.5 | No | SiYuan v3.1.12 before v3.8.6 fails to restrict the Sprig template function map in the /api/icon/getDynamicIcon content parameter, allowing r... | 2026-10-13 |
| CVE-2026-109226 | high | 7.5 | No | SGLang through 0.5.21 contains a decompression amplification vulnerability in load_audio that allows remote attackers to exhaust memory by s... | 2026-10-13 |
| CVE-2026-109185 | high | 8.8 | No | jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users t... | 2026-10-13 |
| CVE-2026-109180 | medium | 4.3 | No | jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to read data from unassigned warehouses by... | 2026-10-13 |
| CVE-2026-108901 | low | 3.5 | No | A vulnerability was found in Shenzhen HCC Technology MPOS M6 PLUS 1.31-N. Affected by this vulnerability is an unknown functionality of the... | 2026-10-13 |
| CVE-2026-108897 | medium | 5.3 | No | A security vulnerability has been detected in Smart Media4U Technology SHAREit App 6.27.38_ww on Android. The impacted element is the functi... | 2026-10-13 |
| CVE-2026-108893 | critical | 9.9 | No | A vulnerability was identified in Linksys E1700 up to 1.0.0.4.003. This issue affects the function setVlan of the file /goform/setVlan. Such... | 2026-10-13 |
| CVE-2026-109168 | medium | 6.5 | No | lamp-cloud through 5.10.1 contains an insecure direct object reference vulnerability that allows authenticated users to list other business... | 2026-10-13 |
| CVE-2026-108836 | high | 7.3 | No | A vulnerability has been found in Ollama up to 0.34.1. The affected element is the function IsValid of the file types/model/name.go of the c... | 2026-10-13 |
| CVE-2026-108830 | medium | 4.2 | No | A weakness has been identified in meetecho janus-gateway up to 1.4.2. This affects an unknown part of the file src/plugins/janus_videoroom.c... | 2026-10-13 |
| CVE-2026-108826 | high | 7.3 | No | A vulnerability was found in Zen Cart up to 2.2.2. This impacts the function zen_db_perform in the library includes/modules/payment/paypaldp... | 2026-10-13 |
| CVE-2026-108821 | medium | 6.3 | No | A security vulnerability has been detected in Tencent WeKnora up to 0.8.1. Impacted is the function validateSubquery of the file internal/ut... | 2026-10-13 |
| CVE-2026-108813 | medium | 6.3 | No | A vulnerability was detected in SEMCMS up to 5.0. This affects an unknown function of the file SEMCMS_Download.php. Performing a manipulatio... | 2026-10-13 |
| CVE-2026-108809 | low | 3.5 | No | A vulnerability was identified in Eleveo Call Recording Software up to 10.3.0. This issue affects some unknown processing of the file /auth/... | 2026-10-13 |
| CVE-2026-108805 | high | 7.3 | No | A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability... | 2026-10-13 |
| CVE-2026-108801 | medium | 6.3 | No | A security flaw has been discovered in prasathmani TinyFileManager up to 2.6. The impacted element is the function move_uploaded_file of the... | 2026-10-13 |
| CVE-2026-106016 | critical | 9.8 | No | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox 157.0.1 and Thunderbird 158. | 2026-10-13 |
| CVE-2026-106425 | medium | 4.2 | No | Missing authorization in BrowserTag in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer proce... | 2026-10-13 |