Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-11402 | critical | 9.8 | No | A vulnerability has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected by this vulnerability is an unknown functio... | 2026-10-08 |
| CVE-2025-11401 | critical | 9.8 | No | A flaw has been found in SourceCodester Hotel and Lodge Management System 1.0. Affected is an unknown function of the file /pages/save_curr.... | 2026-10-08 |
| CVE-2025-11400 | critical | 9.8 | No | A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This impacts an unknown function of the file /del_room... | 2026-10-08 |
| CVE-2025-11399 | critical | 9.8 | No | A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the... | 2026-10-08 |
| CVE-2025-11397 | critical | 9.8 | No | A security flaw has been discovered in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of... | 2026-10-08 |
| CVE-2025-11396 | critical | 9.8 | No | A vulnerability was identified in code-projects Simple Food Ordering System 1.0. Impacted is an unknown function of the file /product.php. S... | 2026-10-08 |
| CVE-2025-11354 | critical | 9.8 | No | A flaw has been found in code-projects Online Hotel Reservation System 1.0. Affected is an unknown function of the file /admin/addslideexec.... | 2026-10-08 |
| CVE-2025-59943 | critical | 9.8 | No | phpMyFAQ is an open source FAQ web application. Versions 4.0-nightly-2025-10-03 and below do not enforce uniqueness of email addresses durin... | 2026-10-08 |
| CVE-2025-61932 | critical | 9.8 | Listed | Lanscope Endpoint Manager (On-Premises) (Client program (MR) and Detection agent (DA)) improperly verifies the origin of incoming requests,... | 2026-10-08 |
| CVE-2026-107703 | critical | 9.8 | No | @enmaso/node-convert through 1.0.0 contains an OS command injection vulnerability in convert.js that allows attackers to execute shell comma... | 2026-10-08 |
| CVE-2026-61801 | medium | 5.5 | No | The `github.com/moby/sys/user` package provides Go utilities for parsing and looking up entries in Unix-style user and group database files.... | 2026-10-08 |
| CVE-2026-9209 | critical | 9.8 | No | mJobTime through build 15.7.3.32 contains an unauthenticated SQL execution vulnerability in the Login.aspx admin panel handlers, where the r... | 2026-10-08 |
| CVE-2026-107640 | critical | 9.1 | No | Integrics Enswitch 3.13 through 4.4 contains an authentication bypass vulnerability in /api/json/user/password/update/ that allows unauthent... | 2026-10-08 |
| CVE-2026-89191 | medium | 6.8 | No | Unsanitised input in the "template name" field of SQLView KRIS's Workflow Template feature is rendered in "onclick" attributes on the main d... | 2026-10-08 |
| CVE-2026-105110 | critical | 9.8 | No | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute... | 2026-10-08 |
| CVE-2026-107450 | medium | 5.4 | No | In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations (crates/graphql/src/mutation/smart_lists.rs) depend only... | 2026-10-08 |
| CVE-2026-107449 | low | 3.4 | No | linuxserver Heimdall through 2.8.3 applies its SafeUrlFetcher SSRF protection mechanism only to ItemController; the enhanced-application tes... | 2026-10-08 |
| CVE-2026-56851 | high | 7.5 | No | The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer. | 2026-10-08 |
| CVE-2026-105828 | not reported | — | No | Parse Server 8.2.2 before 8.6.92 and 9.0.0 before 9.10.1-alpha.12 contains an information disclosure vulnerability in which GraphQL validati... | 2026-10-08 |
| CVE-2026-107376 | high | 8.2 | No | webonyx graphql-php is a PHP implementation of the GraphQL specification. Prior to 15.32.3, GraphQL\Language\Parser performs recursive desce... | 2026-10-08 |