Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93933 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Rosalinda rosalinda allows Object Injection.This issue affects Rosalinda:... | 2026-10-13 |
| CVE-2026-93932 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smart Casa smart-casa allows Object Injection.This issue affects Smart Cas... | 2026-10-13 |
| CVE-2026-93931 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Smash smash allows Object Injection.This issue affects Smash: from n/a thr... | 2026-10-13 |
| CVE-2026-93930 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Tantra tantra allows Object Injection.This issue affects Tantra: from n/a... | 2026-10-13 |
| CVE-2026-93929 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Travesia travesia allows Object Injection.This issue affects Travesia: fro... | 2026-10-13 |
| CVE-2026-93927 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Axiomthemes Veto veto allows Object Injection.This issue affects Veto: from n/a through 1... | 2026-10-13 |
| CVE-2026-62046 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Gutentype gutentype allows Object Injection.This issue affects Gutentype:... | 2026-10-13 |
| CVE-2026-62045 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in ThemeREX Group Booklovers booklovers allows Object Injection.This issue affects Booklover... | 2026-10-13 |
| CVE-2026-106606 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in YITH YITH WooCommerce Affiliates yith-woocommerce-affiliates allows Object Injection.This... | 2026-10-13 |
| CVE-2026-108704 | medium | 4.3 | No | CordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission che... | 2026-10-13 |
| CVE-2026-107225 | medium | 6.5 | No | Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.0 to 2.11.0, GetStyle's fill, border, and f... | 2026-10-13 |
| CVE-2026-108593 | medium | 6.4 | No | 9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allow... | 2026-10-13 |
| CVE-2026-108549 | high | 8.1 | No | cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go tha... | 2026-10-13 |
| CVE-2026-75025 | medium | 4.7 | No | Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content... | 2026-10-13 |
| CVE-2026-12284 | low | 3.7 | No | Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromi... | 2026-10-13 |
| CVE-2026-75588 | low | 2.6 | No | Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connecte... | 2026-10-13 |
| CVE-2026-102110 | medium | 5.9 | No | An endpoint used during initial appliance setup did not require authentication and did not correctly enforce its intended state precondition... | 2026-10-13 |
| CVE-2026-102117 | high | 7.2 | No | On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key... | 2026-10-13 |
| CVE-2026-102119 | high | 7.2 | No | A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten... | 2026-10-13 |
| CVE-2026-102136 | medium | 6.3 | No | In multi-node deployments, an attacker who had already obtained code execution on one appliance node could submit a value through an interna... | 2026-10-13 |