Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88396 | high | 7.2 | No | ApiAdmin v5.0 and before is vulnerable to Directory Traversal. The admin file-upload endpoint POST /admin/Index/upload in ApiAdmin takes the... | 2026-10-06 |
| CVE-2026-88394 | high | 7.5 | No | WookTeam v1.6.6 and before is vulnerable to a Directory Traversal. The project task export endpoint /api/project/task/export downloads an ar... | 2026-10-06 |
| CVE-2026-105186 | medium | 6.3 | No | A flaw has been found in itsourcecode Online Admission System 1.0. This impacts an unknown function of the file /new.php. Executing a manipu... | 2026-10-06 |
| CVE-2026-105292 | medium | 5.9 | No | Chaterm before 0.12.1 contains a login cross-site request forgery vulnerability that allows remote attackers to inject login state by sendin... | 2026-10-06 |
| CVE-2026-105182 | high | 7.3 | No | A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /re... | 2026-10-06 |
| CVE-2026-105178 | medium | 4.7 | No | A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. The impacted element is the function mysqli_real_escap... | 2026-10-06 |
| CVE-2026-105174 | medium | 5.4 | No | A vulnerability has been found in Gerapy up to 0.9.13. This vulnerability affects the function project_create of the file gerapy/server/core... | 2026-10-06 |
| CVE-2026-105170 | high | 7.3 | No | A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9... | 2026-10-06 |
| CVE-2026-105166 | high | 7.3 | No | A vulnerability was found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd... | 2026-10-06 |
| CVE-2026-105161 | medium | 5.3 | No | A flaw has been found in invariant-systems-ai aiir up to 1.7.0. The affected element is an unknown function of the component Policy Gate Han... | 2026-10-06 |
| CVE-2026-105089 | high | 8.7 | No | WWBN AVideo through 29.2.0 contains a stored cross-site scripting vulnerability that allows users with upload permission to inject script by... | 2026-10-06 |
| CVE-2026-105149 | high | 7.3 | No | A security flaw has been discovered in mooSocial up to 3.2.4. This issue affects some unknown processing of the file /stores/all-products. P... | 2026-10-06 |
| CVE-2026-105145 | medium | 5.3 | No | A vulnerability has been found in Weaviate Verba up to 2.1.3. Affected by this vulnerability is the function get_environment of the file gol... | 2026-10-06 |
| CVE-2026-105135 | critical | 10.0 | No | A vulnerability has been found in InternLM MindSearch 0.1.0. This issue affects the function ExecutionAction.run of the file mindsearch/agen... | 2026-10-06 |
| CVE-2025-59872 | critical | 9.8 | No | HCL ZIE for Web is affetced by an Unrestricted File Upload vulnerability, If the server is configured to execute code, then it may be possib... | 2026-10-06 |
| CVE-2026-35477 | critical | 9.9 | No | InvenTree is an Open Source Inventory Management System. From 1.2.3 to 1.2.6, the fix for CVE-2026-27629 upgraded the PART_NAME_FORMAT valid... | 2026-10-06 |
| CVE-2026-31818 | critical | 9.9 | No | Budibase is an open-source low-code platform. Prior to version 3.33.4, a server-side request forgery (SSRF) vulnerability exists in Budibase... | 2026-10-06 |
| CVE-2026-35053 | critical | 9.8 | No | OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow... | 2026-10-06 |
| CVE-2026-97818 | high | 8.6 | No | phpIPAM through 1.8.3 has incorrect authorization for id=="admins" and id=="all" in api/controllers/User.php. | 2026-10-06 |
| CVE-2026-84292 | high | 7.5 | No | fast-uri serializes the port component of a URI without validating it. When recomposing the authority, the userinfo and host components are... | 2026-10-06 |