Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107220 | medium | 6.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.1 to 2.11.0, mergeCellsParser leaves the ca... | 2026-10-13 |
| CVE-2026-107221 | medium | 6.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.0.0 to 2.11.0, checkRow sizes its target cell... | 2026-10-13 |
| CVE-2026-107222 | medium | 6.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.7.0 to 2.11.0, conditional-format extraction... | 2026-10-13 |
| CVE-2026-107223 | high | 7.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, flatCols expands file-loaded c... | 2026-10-13 |
| CVE-2026-73642 | not reported | — | No | Dayforce ESS Excelity is vulnerable to Path Traversal in file download functionality. An unauthenticated attacker can sent GET request with... | 2026-10-13 |
| CVE-2026-73641 | not reported | — | No | Dayforce ESS Excelity is vulnerable to Reflected XSS in multiple endpoints. An attacker can prepare a specially crafted URL that, when opene... | 2026-10-13 |
| CVE-2026-73640 | not reported | — | No | Dayforce ESS Excelity is vulnerable to Time Based-Blind SQL Injection in password recovery functionality. The unauthenticated attacker can p... | 2026-10-13 |
| CVE-2026-54459 | medium | 4.3 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.14.0, FileRise authentica... | 2026-10-13 |
| CVE-2026-15399 | medium | 4.9 | No | The Animated Number Counters plugin for WordPress is vulnerable to generic SQL Injection via the 'counterid' parameter in all versions up to... | 2026-10-13 |
| CVE-2026-17189 | medium | 6.1 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. T... | 2026-10-13 |
| CVE-2026-109960 | high | 7.7 | No | Froxlor 2.0.0 before 2.3.14 contains a stored cross-site scripting vulnerability that allows authenticated customers to inject HTML and Java... | 2026-10-13 |
| CVE-2026-109955 | medium | 5.3 | No | Hono from 4.12.4 before 4.13.11 contains a middleware bypass vulnerability in serveStatic that allows unauthenticated attackers to skip pref... | 2026-10-13 |
| CVE-2026-107224 | medium | 6.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, a Zip64 uncompressed size with... | 2026-10-13 |
| CVE-2026-109674 | medium | 6.5 | No | Frappe ERPNext before 15.98.0 and 16.x before 16.6.0 contains an SQL injection vulnerability in some endpoints caused by missing input valid... | 2026-10-13 |
| CVE-2026-109669 | medium | 4.3 | No | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-13 |
| CVE-2026-109664 | medium | 4.3 | No | Frappe ERPNext before 15.112.0 contains a missing authorization vulnerability that allows authenticated users with a common operational role... | 2026-10-13 |
| CVE-2026-109659 | medium | 6.5 | No | Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-13 |
| CVE-2026-109654 | medium | 5.4 | No | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in which certain endpoints fail to ver... | 2026-10-13 |
| CVE-2026-109649 | medium | 6.5 | No | Frappe ERPNext before 15.102.0 and 16.x before 16.11.0 contains an SQL injection vulnerability in some endpoints due to missing input valida... | 2026-10-13 |
| CVE-2026-109644 | medium | 6.5 | No | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |