Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106455 | high | 7.7 | No | Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node pac... | 2026-10-13 |
| CVE-2026-106459 | high | 8.5 | No | Backstage is an open framework for building developer portals. From 0.3.0 until 0.3.8, the @backstage/plugin-scaffolder-backend-module-sentr... | 2026-10-13 |
| CVE-2026-106552 | medium | 6.5 | No | In sftp in OpenSSH before 10.6, a server can trigger directory traversal (causing files to be written to unintended locations) during a recu... | 2026-10-13 |
| CVE-2026-106553 | high | 7.5 | No | In sshd in OpenSSH before 10.6, credentials can incorrectly persist after failure of a GSSAPIAuthentication authentication attempt. | 2026-10-13 |
| CVE-2026-84318 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginx_config_add writes nginx configura... | 2026-10-13 |
| CVE-2026-84316 | high | 8.8 | No | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, config.ValidateConfigDirectives splits configuration by newline a... | 2026-10-13 |
| CVE-2026-49243 | critical | 9.6 | No | Webmin is a web-based system administration tool for Unix-like servers. Prior to version 2.650, Webmin users who click on a malicious link t... | 2026-10-13 |
| CVE-2026-108828 | medium | 4.1 | No | A vulnerability was identified in Zen Cart 2.2.2. Affected by this vulnerability is the function eval of the file admin/configuration.php of... | 2026-10-13 |
| CVE-2026-108824 | medium | 6.3 | No | A flaw has been found in DataEase up to 3.0.0. The impacted element is the function Utils.buildCalcField of the file io/dataease/engine/util... | 2026-10-13 |
| CVE-2026-108819 | high | 7.3 | No | A security flaw has been discovered in agno-agi agno up to 3.0.6/3.1.1. This vulnerability affects the function exec of the component Agent... | 2026-10-13 |
| CVE-2026-108815 | low | 3.5 | No | A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to... | 2026-10-13 |
| CVE-2026-108811 | medium | 4.3 | No | A weakness has been identified in WMCMS 4.446.1257. The affected element is an unknown function of the file /index.php. This manipulation of... | 2026-10-13 |
| CVE-2026-108807 | high | 7.3 | No | A vulnerability was found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects the function... | 2026-10-13 |
| CVE-2026-108803 | medium | 6.3 | No | A security vulnerability has been detected in y_project RuoYi up to 4.8.3. This impacts the function changeStatus of the file /system/config... | 2026-10-13 |
| CVE-2026-108799 | high | 7.3 | No | A vulnerability was determined in jackq XCMS up to 3fab5342cc509945a7ce1b8ec39d19f701b89261. Impacted is the function PublicController::send... | 2026-10-13 |
| CVE-2026-108789 | medium | 5.5 | No | A vulnerability was identified in deepseek-ai deepseek-harness up to 0.1.1-rc.2. This affects the function agent of the component dsh-workfl... | 2026-10-13 |
| CVE-2026-108785 | medium | 6.3 | No | A flaw has been found in macrozheng mall up to 1.0.3. This issue affects the function JwtTokenUtil.refreshHeadToken of the file /admin/refre... | 2026-10-13 |
| CVE-2026-108781 | medium | 6.3 | No | A security flaw has been discovered in erzhongxmu JEEWMS up to 2026.09.27-W39. Affected by this vulnerability is the function WmToMoveGoodsC... | 2026-10-13 |
| CVE-2026-106331 | medium | 6.5 | No | Improper input validation in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to b... | 2026-10-13 |
| CVE-2026-106385 | medium | 5.3 | No | Race condition in Chromoting in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially... | 2026-10-13 |