Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51917 | high | 7.3 | No | FinRobot v1.0.0 is vulnerable to Code Injection in CodingUtils.modify_code. | 2026-10-05 |
| CVE-2026-51914 | high | 8.8 | No | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller. In affected source snapshots... | 2026-10-05 |
| CVE-2026-51911 | critical | 9.8 | No | vanna v2.0.2 contains a code injection vulnerability in VannaBase.get_plotly_figure (src/vanna/legacy/base/base.py). Depending on the expose... | 2026-10-05 |
| CVE-2026-51904 | critical | 9.8 | No | SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, cr... | 2026-10-05 |
| CVE-2026-51901 | high | 8.1 | No | SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control. The agent execution controller endpoint /api/agentexecutions/schedule allow... | 2026-10-05 |
| CVE-2026-51897 | critical | 9.8 | No | RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app). Depending on the exposed entry, an attacker can tr... | 2026-10-05 |
| CVE-2026-51896 | medium | 6.5 | No | infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py). Depending on the exposed entry, an attacke... | 2026-10-05 |
| CVE-2026-51893 | critical | 9.8 | No | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap. An externally reachable path accepts a caller-selecte... | 2026-10-05 |
| CVE-2026-51892 | medium | 6.5 | No | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/. | 2026-10-05 |
| CVE-2026-51884 | critical | 9.8 | No | The /knowledge_base/upload_temp_docs temporary document upload endpoint in Langchain Chatchat 0.3.1 is vulnerable to path traversal. By craf... | 2026-10-05 |
| CVE-2026-51883 | critical | 9.1 | No | The knowledge base creation and document upload interfaces in Langchain-Chatchat 0.3.0;0.3.1 is vulnerable to path traversal. An attacker ca... | 2026-10-05 |
| CVE-2026-51879 | critical | 9.1 | No | deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file. A remote cal... | 2026-10-05 |
| CVE-2026-51874 | high | 7.5 | No | In Devika v1.0, the Patcher Agent save_code_to_project function contains a path traversal vulnerability that allows attackers to write files... | 2026-10-05 |
| CVE-2026-105640 | critical | 9.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane trusts email addresses returned by Gitea OAuth and by self-managed Gi... | 2026-10-05 |
| CVE-2026-105638 | critical | 9.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane's magic-code email login uses a six-digit numeric OTP with approximat... | 2026-10-05 |
| CVE-2026-105635 | high | 7.4 | No | Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/joi... | 2026-10-05 |
| CVE-2026-105633 | high | 7.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, the V2 issue-attachment PATCH endpoint accepts issue_id in the URL but omit... | 2026-10-05 |
| CVE-2026-105630 | high | 8.7 | No | Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upl... | 2026-10-05 |
| CVE-2026-104977 | high | 7.7 | No | Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item li... | 2026-10-05 |
| CVE-2026-104975 | high | 7.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remed... | 2026-10-05 |