Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105950 | low | 3.5 | No | A security vulnerability has been detected in getformwork formwork up to 2.3.12. Impacted is the function DomSanitizer::sanitizeNodeAttribut... | 2026-10-06 |
| CVE-2026-106026 | low | 3.7 | No | tftp-hpa 5.4 before 6.0 contains an out-of-bounds read vulnerability in rewrite_string() in tftpd/remap.c that walks heap memory during jump... | 2026-10-06 |
| CVE-2026-105919 | high | 7.3 | No | A vulnerability was found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The affected element is... | 2026-10-06 |
| CVE-2026-105918 | high | 7.3 | No | A vulnerability has been found in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Impacted is the fu... | 2026-10-06 |
| CVE-2026-105800 | low | 3.7 | No | i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacke... | 2026-10-06 |
| CVE-2026-105799 | not reported | — | No | LangChain is a framework for building LLM-powered applications. Prior to 1.1.1, @langchain/redis does not escape attacker-controlled values... | 2026-10-06 |
| CVE-2026-105797 | high | 8.8 | No | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. In versions 0.261.... | 2026-10-06 |
| CVE-2026-105795 | low | 3.1 | No | Kiota is an OpenAPI based HTTP Client code generator. From 1.25.1 until 1.35.0, Kiota copies x-ai-capabilities.response_semantics.oauth_card... | 2026-10-06 |
| CVE-2026-105794 | not reported | — | No | MsQuic is a cross-platform C implementation of the IETF QUIC protocol exposed to C, C++, C#, and Rust. Prior to 2.4.20, 2.5.11, and 2.6.1, M... | 2026-10-06 |
| CVE-2026-105838 | medium | 5.5 | No | libmikmod before 3.3.14 contains a heap out-of-bounds read vulnerability in the Impulse Tracker loader load_it.c that allows attackers to re... | 2026-10-06 |
| CVE-2026-105792 | medium | 6.5 | No | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the /api/task_result/{tas... | 2026-10-06 |
| CVE-2026-105790 | medium | 6.4 | No | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, authenticated device regi... | 2026-10-06 |
| CVE-2026-105778 | critical | 9.9 | No | A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/set... | 2026-10-06 |
| CVE-2026-105707 | medium | 5.3 | No | A security vulnerability has been detected in uptrace up to 2.1.0-beta.8. Affected by this vulnerability is the function Login of the file p... | 2026-10-06 |
| CVE-2026-105786 | not reported | — | No | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, packages/server/s... | 2026-10-06 |
| CVE-2026-105703 | medium | 4.7 | No | A vulnerability was determined in PHPGurukul User Registration & Login and User Management System 3.3. The impacted element is an unknown fu... | 2026-10-06 |
| CVE-2026-105573 | medium | 4.3 | No | A vulnerability was found in newbee-ltd newbee-mall up to 2.7.5. This impacts an unknown function of the file /jshERP-boot/accountHead/updat... | 2026-10-06 |
| CVE-2026-105486 | high | 7.3 | No | A vulnerability was detected in OSSRS srs up to 7.0-a1. This affects the function systemAPI.Run of the file internal/proxy/api.go of the com... | 2026-10-06 |
| CVE-2026-105470 | high | 7.3 | No | A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue a... | 2026-10-06 |
| CVE-2026-105438 | medium | 4.3 | No | A flaw has been found in O2OA up to 10.0.1-ce. This affects the function ActionUploadExcelWithUrl of the file /x_general_assemble_control/ja... | 2026-10-06 |