Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-42713 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopiplus Post title marquee scroll pos... | 2026-10-07 |
| CVE-2026-48558 | critical | 10.0 | Listed | SimpleHelp versions 5.5.15 and prior and 6.0 pre-release versions contain an authentication bypass vulnerability in the OIDC authentication... | 2026-10-07 |
| CVE-2026-106550 | high | 7.5 | No | Mozilla's Node-convict (version 6.2.2 and later) is vulnerable to a Denial of Service vulnerability caused by incomplete prototype‑pollution... | 2026-10-07 |
| CVE-2026-106064 | medium | 6.3 | No | A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit ov... | 2026-10-07 |
| CVE-2026-103870 | medium | 5.0 | No | A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user... | 2026-10-07 |
| CVE-2026-91012 | critical | 9.8 | No | org.apache.karaf.config.core.impl.ConfigRepositoryImpl#update(pid, properties), which backs the "config" MBean and the config:* shell comman... | 2026-10-07 |
| CVE-2026-91048 | critical | 9.8 | No | The jdbc shell command scope shipped no org.apache.karaf.command.acl.jdbc.cfg. Karaf's command guard (SecuredSessionFactoryImpl) treats a co... | 2026-10-07 |
| CVE-2026-91085 | medium | 6.3 | No | Apache Karaf's shell/SSH command security is enforced by per-scope ACL configuration files (etc/org.apache.karaf.command.acl..cfg). SecuredS... | 2026-10-07 |
| CVE-2025-14585 | critical | 9.8 | No | A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file... | 2026-10-07 |
| CVE-2025-14584 | critical | 9.8 | No | A vulnerability has been found in itsourcecode COVID Tracking System 1.0. Affected is an unknown function of the file /admin/login.php of th... | 2026-10-07 |
| CVE-2025-14583 | critical | 9.8 | No | A flaw has been found in campcodes Online Student Enrollment System 1.0. This impacts an unknown function of the file /admin/register.php. E... | 2026-10-07 |
| CVE-2025-14578 | critical | 9.8 | No | A weakness has been identified in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /updat... | 2026-10-07 |
| CVE-2025-14571 | critical | 9.8 | No | A vulnerability has been found in projectworlds Advanced Library Management System 1.0. Affected by this issue is some unknown functionality... | 2026-10-07 |
| CVE-2025-14570 | critical | 9.8 | No | A flaw has been found in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of... | 2026-10-07 |
| CVE-2025-14566 | critical | 9.8 | No | A security flaw has been discovered in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The impacted element is... | 2026-10-07 |
| CVE-2025-14565 | critical | 9.8 | No | A vulnerability was identified in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. The affected element is an un... | 2026-10-07 |
| CVE-2025-54947 | critical | 9.8 | No | In Apache StreamPark versions 2.0.0 through 2.1.7, a security vulnerability involving a hard-coded encryption key exists. This vulnerability... | 2026-10-07 |
| CVE-2025-67727 | critical | 9.8 | No | Parse Server is an open source backend that can be deployed to any infrastructure that runs Node.js. In versions prior to 8.6.0-alpha.2, a G... | 2026-10-07 |
| CVE-2025-66419 | critical | 10.0 | No | MaxKB is an open-source AI assistant for enterprise. In versions 2.3.1 and below, the tool module allows an attacker to escape the sandbox e... | 2026-10-07 |
| CVE-2025-66590 | critical | 9.8 | No | In AzeoTech DAQFactory release 20.7 (Build 2555), an out-of-bounds write vulnerability can be exploited by an attacker to cause the program... | 2026-10-07 |