Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106038 | high | 8.2 | No | Mooncake Store master through 0.3.13.post1 contains a missing authentication vulnerability that allows unauthenticated attackers to force-de... | 2026-10-09 |
| CVE-2026-105957 | medium | 6.3 | No | A vulnerability was detected in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /op... | 2026-10-09 |
| CVE-2026-105920 | high | 7.3 | No | A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted eleme... | 2026-10-09 |
| CVE-2026-105844 | not reported | — | No | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-... | 2026-10-09 |
| CVE-2026-105801 | not reported | — | No | openapi-python-client generates Python clients from OpenAPI documents. Prior to 0.29.1, the generator does not safely neutralize malicious O... | 2026-10-09 |
| CVE-2026-105840 | high | 7.5 | No | lrzsz before 0.13.0 contains a path traversal vulnerability in the lrz receive utility's restricted mode that allows malicious ZMODEM sender... | 2026-10-09 |
| CVE-2026-105835 | high | 7.4 | No | PLANKA 2.2.0 through 2.2.1 fails to limit incorrect TOTP codes submitted to POST /api/access-tokens/verify-totp, allowing attackers to brute... | 2026-10-09 |
| CVE-2026-105808 | low | 3.5 | No | A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the... | 2026-10-09 |
| CVE-2026-104070 | critical | 9.8 | No | The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbi... | 2026-10-09 |
| CVE-2026-105796 | high | 8.8 | No | Kiota is an OpenAPI based HTTP Client code generator. From 0.5.0 until 1.35.0, Kiota's Java and PHP documentation-comment sanitizers delete... | 2026-10-09 |
| CVE-2026-105791 | high | 7.5 | No | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run_shell tool in the... | 2026-10-09 |
| CVE-2026-105775 | medium | 4.3 | No | A security vulnerability has been detected in vllm-project vLLM up to 0.31.0. This impacts the function conv_ssm_forward of the file vllm/mo... | 2026-10-09 |
| CVE-2023-51714 | critical | 9.8 | No | An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x bef... | 2026-10-08 |
| CVE-2023-26119 | critical | 9.8 | No | Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, wh... | 2026-10-08 |
| CVE-2022-32511 | critical | 9.8 | No | jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable. | 2026-10-08 |
| CVE-2021-29921 | critical | 9.8 | No | In Python before 3,9,5, the ipaddress library mishandles leading zero characters in the octets of an IP address string. This (in some situat... | 2026-10-08 |
| CVE-2021-23450 | critical | 9.8 | No | All versions of package dojo are vulnerable to Prototype Pollution via the setObject function. | 2026-10-08 |
| CVE-2021-23383 | critical | 9.8 | No | The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates comi... | 2026-10-08 |
| CVE-2021-23369 | critical | 9.8 | No | The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templa... | 2026-10-08 |
| CVE-2020-7788 | critical | 9.8 | No | This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they... | 2026-10-08 |