Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109309 | medium | 6.5 | No | SiYuan v3.7.0 before v3.8.6 contains an absolute path traversal vulnerability in the kernel's private plugin HTTP server, which passes a ker... | 2026-10-13 |
| CVE-2026-109225 | high | 7.5 | No | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability that allows unauthenticated remote attackers to exhaust memory b... | 2026-10-13 |
| CVE-2026-108921 | high | 7.3 | No | A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the fun... | 2026-10-13 |
| CVE-2026-108919 | medium | 4.3 | No | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. The impacted element is an unknown function of the file Aut... | 2026-10-13 |
| CVE-2026-108917 | critical | 10.0 | No | A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. E... | 2026-10-13 |
| CVE-2026-108915 | critical | 9.9 | No | A vulnerability has been found in Edimax BR-6208AC 1.32. This affects an unknown part of the file /goform/formWlanMP. Such manipulation of t... | 2026-10-13 |
| CVE-2026-109184 | medium | 4.3 | No | jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement acc... | 2026-10-13 |
| CVE-2026-109179 | medium | 4.3 | No | jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's o... | 2026-10-13 |
| CVE-2026-108909 | medium | 4.3 | No | A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI E... | 2026-10-13 |
| CVE-2026-108907 | critical | 10.0 | No | A vulnerability was determined in Netcore NR268 1.7.121109. Affected is the function user_ok of the component CGI Execution. This manipulati... | 2026-10-13 |
| CVE-2026-108904 | medium | 6.5 | No | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an information disclosure vulnerability that allows API clients to obtain sensitiv... | 2026-10-13 |
| CVE-2026-108747 | medium | 4.2 | No | Lightdash through 2.556.0 contains an authorization bypass vulnerability that allows authenticated organization members to delete other user... | 2026-10-13 |
| CVE-2026-108159 | high | 7.5 | No | AstronRPA through 1.1.6 contains a cross-site scripting vulnerability in the desktop client's smart-component chat that allows remote attack... | 2026-10-13 |
| CVE-2026-108119 | medium | 6.3 | No | A flaw was found in busybox. The tar applet's deferred link-creation handling for symlink and hardlink entries with unsafe-looking targets d... | 2026-10-13 |
| CVE-2026-108113 | high | 8.8 | No | ILIAS before 9.24, 10.12, and 11.5 contains an unrestricted file upload vulnerability in QTI question import image handling (ilQtiMatImageSe... | 2026-10-13 |
| CVE-2026-108106 | high | 7.5 | No | Xerial snappy-java before 1.1.10.9 contains an unbounded memory allocation vulnerability that allows attackers to exhaust JVM memory by decl... | 2026-10-13 |
| CVE-2026-108101 | high | 7.5 | No | HortusFox (hortusfox-web) through 6.3 contains an unrestricted file upload vulnerability in PlantAttachmentModel that allows authenticated u... | 2026-10-13 |
| CVE-2026-107889 | medium | 5.5 | No | A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning u... | 2026-10-13 |
| CVE-2026-107830 | medium | 5.3 | No | Jivejdon from commit e0306088 through commit ee67a65e lacks rate limiting on the unauthenticated /account/smsVRAction endpoint handled by Sm... | 2026-10-13 |
| CVE-2026-107737 | not reported | — | No | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, and in pre-release 3.7.0.20369 when WebView2 is absent or cannot init... | 2026-10-13 |