Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109639 | medium | 6.5 | No | Frappe ERPNext before 15.102.0 and 16.x before 16.8.0 contains an SQL injection vulnerability in some endpoints due to missing input validat... | 2026-10-13 |
| CVE-2026-109634 | medium | 4.9 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains an SQL injection vulnerability in some endpoints due to missing input valida... | 2026-10-13 |
| CVE-2026-109629 | medium | 4.3 | No | Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in an endpoint that sends transactiona... | 2026-10-13 |
| CVE-2026-109624 | medium | 6.5 | No | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |
| CVE-2026-109616 | high | 7.1 | No | Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in which certain endpoints fail to enf... | 2026-10-13 |
| CVE-2026-109611 | medium | 4.3 | No | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enfo... | 2026-10-13 |
| CVE-2026-109603 | low | 3.3 | No | Frappe Framework 15.x before 15.107.3 and 16.x before 16.17.0 relies on a vulnerable pdfkit library (CVE-2025-26240) for PDF generation, ena... | 2026-10-13 |
| CVE-2026-109598 | medium | 4.3 | No | Frappe Framework before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in the whitelisted send_sms API endp... | 2026-10-13 |
| CVE-2026-109573 | high | 8.1 | No | phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape(), which escapes single quotes with backslashes that are t... | 2026-10-13 |
| CVE-2026-109155 | medium | 6.3 | No | A flaw has been found in DeepPavlov up to 1.7.0. This impacts the function untar of the component Model Download Handler. This manipulation... | 2026-10-13 |
| CVE-2026-109144 | medium | 5.3 | No | A vulnerability was identified in wbond certvalidator up to 0.11.1. This issue affects some unknown processing of the component Certificate... | 2026-10-13 |
| CVE-2026-109114 | high | 7.3 | No | A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerabi... | 2026-10-13 |
| CVE-2026-109107 | medium | 6.5 | No | A weakness has been identified in Wavlink WL-WN592AX6 250422. Affected by this issue is the function main of the file /cgi-bin/upload.cgi. T... | 2026-10-13 |
| CVE-2026-108973 | high | 7.3 | No | A vulnerability was determined in SourceCodester Contact Tracing System 1.0. Affected by this issue is the function move_uploaded_file of th... | 2026-10-13 |
| CVE-2026-108969 | high | 7.3 | No | A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The i... | 2026-10-13 |
| CVE-2026-108965 | high | 7.3 | No | A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opil... | 2026-10-13 |
| CVE-2026-108960 | medium | 5.3 | No | A vulnerability was detected in Tiiny-AI PowerInfer up to 8bd56d69906c9d2dba4d3bf6899763401e01a9a4. Affected is the function create_striped_... | 2026-10-13 |
| CVE-2026-108956 | high | 7.3 | No | A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewe... | 2026-10-13 |
| CVE-2026-108947 | medium | 5.3 | No | A flaw has been found in yoshitomo-matsubara torchdistill up to 1.1.5. This affects the function load_ckpt of the file torchdistill/common/m... | 2026-10-13 |
| CVE-2026-108963 | high | 8.8 | No | databasement before 1.8.2 allows remote code execution because it runs certain commands (e.g., mariadb-dump) with a database name that can b... | 2026-10-13 |