Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92821 | medium | 6.8 | No | A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Dire... | 2026-10-06 |
| CVE-2026-95265 | high | 7.5 | No | Feehi CMS 2.1.1 contains a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The private-IP validation do... | 2026-10-06 |
| CVE-2026-84429 | medium | 5.3 | No | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.http.parse_header_parameters()` w... | 2026-10-06 |
| CVE-2026-77050 | medium | 5.3 | No | An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. `django.utils.translation.get_supported_languag... | 2026-10-06 |
| CVE-2026-78860 | high | 7.8 | No | An issue in Mercusys AC12 V2 allows a local attacker to execute arbitrary code via the storage of information in plaintext | 2026-10-06 |
| CVE-2026-71297 | medium | 5.4 | No | A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authent... | 2026-10-06 |
| CVE-2026-51888 | high | 7.5 | No | langflow-ai langflow v1.8.4 is affected by: Directory Traversal. The impact is: Arbitrary file write outside the intended workspace or stora... | 2026-10-06 |
| CVE-2026-105783 | high | 8.0 | No | Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, when Joplin Deskt... | 2026-10-06 |
| CVE-2026-105767 | low | 3.3 | No | Improper Neutralization of Special Elements used in an OS Command in the integrate-platform-docs composite GitHub Action of Chainguard Acade... | 2026-10-06 |
| CVE-2026-105692 | medium | 5.4 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-share-link RPC retrieves a caller-selected share-link... | 2026-10-06 |
| CVE-2026-105687 | medium | 4.9 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the delete-team-member RPC allows a team administrator to remove... | 2026-10-06 |
| CVE-2026-105681 | medium | 6.5 | No | Ghost is a Node.js content management system. From 5.9.0 until 6.44.1, an input validation issue allowed members to access comments they wer... | 2026-10-06 |
| CVE-2026-105676 | medium | 4.9 | No | Ghost is a Node.js content management system. From 1.20.0 until 6.64.0, a vulnerability in how Ghost loads theme translation files allowed a... | 2026-10-06 |
| CVE-2026-105649 | high | 7.3 | No | Ghost is a Node.js content management system. From 4.22.0 until 6.65.0, SVG media thumbnails and SVG images uploaded with a non-SVG file ext... | 2026-10-06 |
| CVE-2026-104852 | not reported | — | No | GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemas. Prior to 12.0.1, the GraphQL Tools utils package's me... | 2026-10-06 |
| CVE-2026-105644 | medium | 6.8 | No | Ghost is a Node.js content management system. From 4.0.0 until 6.67.0, SVG images included in content imports were stored without sanitizati... | 2026-10-06 |
| CVE-2026-105639 | critical | 9.8 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane's signup flow creates a logged-in User row for any submitted email wi... | 2026-10-06 |
| CVE-2026-105634 | high | 8.1 | No | Plane is an open-source project management tool. Prior to 1.3.0, the ProjectMemberViewSet.partial_update method allows any project member, i... | 2026-10-06 |
| CVE-2026-105629 | high | 7.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, BulkEstimatePointEndpoint.destroy resolves an estimate point through a bare... | 2026-10-06 |
| CVE-2026-104976 | not reported | — | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane validates GITEA_HOST only for its URL scheme and does not reject host... | 2026-10-06 |