Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105222 | high | 7.4 | No | The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets... | 2026-10-06 |
| CVE-2026-105221 | high | 7.4 | No | The gist RubyGem before 6.1.0 contains an improper certificate validation vulnerability that allows on-path attackers to intercept HTTPS tra... | 2026-10-06 |
| CVE-2026-105220 | high | 7.8 | No | Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story fil... | 2026-10-06 |
| CVE-2026-105218 | high | 7.4 | No | gopay before 1.5.119 disables TLS certificate verification in defaultClient() in pkg/xhttp/client.go, allowing man-in-the-middle attackers t... | 2026-10-06 |
| CVE-2026-105123 | high | 8.8 | No | W (vincent-peugnet/wcms) through 3.18.0 contains a remote code execution vulnerability that allows authenticated editors to write arbitrary... | 2026-10-06 |
| CVE-2026-79113 | not reported | — | No | OpenAPV before 1.1.1.0 has a read_bitstream heap-based buffer overflow. | 2026-10-06 |
| CVE-2026-105030 | medium | 5.3 | No | Kener 4.0.0 before 4.1.6 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve hidden or inacti... | 2026-10-06 |
| CVE-2026-104474 | medium | 6.7 | No | OpenLiteSpeed before 1.9.3 contains a local privilege escalation vulnerability in admin/misc/lsup.sh that runs unverified update packages fr... | 2026-10-06 |
| CVE-2026-82041 | critical | 9.9 | No | UTMStack before 11.2.16 contains a missing authorization vulnerability in UTMIncidentCommandWebsocket.processCommand(), the handler mapped t... | 2026-10-06 |
| CVE-2026-104874 | medium | 5.3 | No | Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation... | 2026-10-06 |
| CVE-2023-54405 | critical | 9.8 | No | H3C CVM, the Cloud Virtualization Management component of the H3C CAS cloud platform, contains an unauthenticated arbitrary file upload vuln... | 2026-10-06 |
| CVE-2020-37278 | high | 7.5 | No | Weaver e-Bridge contains an unauthenticated arbitrary file read vulnerability that allows remote attackers to access arbitrary files on the... | 2026-10-06 |
| CVE-2014-125130 | high | 7.5 | No | CodeArt Google MP3 Audio Player plugin (google-mp3-audio-player) for WordPress through 1.0.11 contains an unauthenticated arbitrary file rea... | 2026-10-06 |
| CVE-2026-88391 | critical | 9.8 | No | Northstar (dromara/northstar, quantitative trading platform) <= 9.1.1 enables the H2 Console but its auth interceptor only covers /northstar... | 2026-10-06 |
| CVE-2026-105090 | not reported | — | No | Formbricks before 5.4.4 and 6 before 6.0.1 allows stored XSS. The survey-level Custom Head Scripts feature did not enforce the documented Ma... | 2026-10-06 |
| CVE-2026-105051 | low | 1.9 | No | Denuvo Anti-Tamper through 2026-03-04 allows bypass of a hypervisor presence check via CPUID interception (SimpleSvm.sys on AMD; hyperkd.sys... | 2026-10-06 |
| CVE-2026-105049 | medium | 5.8 | No | Zilliz Attu before 3.0.0 has a Playground feature that does not require authentication for proxying arbitrary HTTP and HTTPS requests to URL... | 2026-10-06 |
| CVE-2026-105043 | low | 3.6 | No | MathWorks Simulink before R2026b, when showing a crafted .slx file, can have blocks that are never visible in the Simulink Editor but will c... | 2026-10-06 |
| CVE-2026-104055 | not reported | — | No | The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user... | 2026-10-06 |
| CVE-2026-105921 | medium | 6.3 | No | A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an un... | 2026-10-06 |