Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103246 | high | 7.7 | No | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac... | 2026-10-06 |
| CVE-2026-103592 | medium | 6.5 | No | simple-php-router through 5.4.1.7 contains an IP restriction bypass vulnerability in the IpRestrictAccess middleware that allows remote unau... | 2026-10-06 |
| CVE-2026-103588 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module... | 2026-10-06 |
| CVE-2026-94544 | medium | 4.2 | No | Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key ar... | 2026-10-05 |
| CVE-2026-93354 | high | 8.1 | No | Taskview Community before 1.56.0 contains a missing authentication vulnerability that allows unauthenticated attackers to register arbitrary... | 2026-10-05 |
| CVE-2026-70650 | not reported | — | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior,... | 2026-10-05 |
| CVE-2026-76782 | high | 7.3 | No | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | 2026-10-05 |
| CVE-2026-55251 | medium | 6.5 | No | NetBox Device Type Library is a collection of community-sourced device type definitions for import into NetBox. Prior to commit f41fc1e, the... | 2026-10-05 |
| CVE-2026-53953 | critical | 9.1 | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In version 3.3.22, the passwo... | 2026-10-05 |
| CVE-2026-105695 | medium | 5.9 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, assemble-chunks retrieves an upload session using only its sessio... | 2026-10-05 |
| CVE-2026-105690 | medium | 5.9 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, logout clears the browser's auth-token cookie without revoking th... | 2026-10-05 |
| CVE-2026-105684 | medium | 4.3 | No | Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC... | 2026-10-05 |
| CVE-2026-105214 | not reported | — | No | Zitadel before 4.16.2 contains a server-side request forgery vulnerability that allows attackers to make the server request internal resourc... | 2026-10-05 |
| CVE-2026-105126 | high | 7.2 | No | LaraDashboard before 1.4.8 contains an improper privilege management vulnerability that allows authenticated Admin users to escalate to Supe... | 2026-10-05 |
| CVE-2026-104859 | not reported | — | No | Nx is a monorepo solution for TypeScript and polyglot codebases. From 21.4.0 until 22.7.8 and from 23.0.0 until 23.1.1, the @nx/docker relea... | 2026-10-05 |
| CVE-2026-104846 | critical | 9.8 | No | Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, from... | 2026-10-05 |
| CVE-2026-104182 | medium | 6.2 | No | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC... | 2026-10-05 |
| CVE-2026-103100 | high | 7.5 | No | Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trig... | 2026-10-05 |
| CVE-2026-103101 | high | 7.5 | No | Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to... | 2026-10-05 |
| CVE-2026-103102 | high | 8.6 | No | Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigge... | 2026-10-05 |