Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103686 | low | 3.5 | No | A flaw has been found in rhukster dom-sanitizer up to 1.0.15. Impacted is the function DOMSanitizer::isDangerousUrl of the file src/DOMSanit... | 2026-10-06 |
| CVE-2026-103291 | medium | 6.4 | No | Ghost versions from 3.20.2 before 6.51.0 contain a server-side request forgery vulnerability in image dimension refetching that allows authe... | 2026-10-06 |
| CVE-2026-103287 | low | 2.7 | No | Ghost versions 1.18.0 before 6.27.0 contain a server-side request forgery vulnerability in the webhooks feature that allows staff users to p... | 2026-10-06 |
| CVE-2026-103283 | high | 8.1 | No | Ghost versions 6.20.0 before 6.57.1 contain a session handling vulnerability that allows authenticated staff users to log in as any other st... | 2026-10-06 |
| CVE-2026-103279 | medium | 6.8 | No | Ghost versions from 3.10.0 before 6.34.0 fail to fully invalidate all sessions after a password change. Attackers with a stolen session cook... | 2026-10-06 |
| CVE-2024-58388 | high | 7.5 | No | Sharp (and Toshiba Tec rebranded) multifunction printers contain an unauthenticated local file inclusion vulnerability that allows remote at... | 2026-10-06 |
| CVE-2026-103275 | medium | 4.3 | No | Ghost 5.42.2 before 6.58.0 contains an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints, w... | 2026-10-06 |
| CVE-2026-51886 | critical | 9.8 | No | langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/ba... | 2026-10-06 |
| CVE-2026-51881 | critical | 9.8 | No | deeptutor 1.4.0 contains code injection in ExecTool.execute. Through the live tutorbot WebSocket interface, a remote caller can induce the t... | 2026-10-06 |
| CVE-2026-51876 | critical | 9.1 | No | DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow. An unauthenticated or unauthorized caller can... | 2026-10-06 |
| CVE-2026-103271 | high | 7.5 | No | Ghost versions from 4.0.0 before 6.63.0 contain a content API vulnerability that allows unauthenticated visitors to access gated post conten... | 2026-10-06 |
| CVE-2026-103542 | medium | 4.3 | No | A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smart_fill of the file /global/code/actions.php of t... | 2026-10-06 |
| CVE-2026-103539 | medium | 5.4 | No | A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/s... | 2026-10-06 |
| CVE-2026-103534 | medium | 6.3 | No | A vulnerability was determined in David-Crty databasement up to 1.7.1. Affected is the function SnapshotPolicy.viewAny/SnapshotPolicy.view o... | 2026-10-06 |
| CVE-2026-103531 | medium | 5.5 | No | A flaw has been found in OpenSC up to 0.27.1. The impacted element is the function setcos_construct_fci_44 of the file src/libopensc/card-se... | 2026-10-06 |
| CVE-2026-103266 | high | 7.1 | No | Ghost versions 5.2.0 through versions prior to 6.62.0 allow a remote attacker, without authentication, to abuse the Stripe Checkout flow to... | 2026-10-06 |
| CVE-2026-103262 | high | 7.5 | No | Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to... | 2026-10-06 |
| CVE-2026-103258 | medium | 6.8 | No | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an unescaped parameter interpolation vulnerability in SendGrid, Freshservice, an... | 2026-10-06 |
| CVE-2026-103254 | medium | 6.3 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resum... | 2026-10-06 |
| CVE-2026-103250 | high | 8.1 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB... | 2026-10-06 |