Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97324 | high | 7.3 | No | A vulnerability was identified in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.08. Affected is the function updateDemoOrderPaid of the file... | 2026-10-05 |
| CVE-2026-97233 | low | 3.5 | No | A vulnerability was identified in volotat Anagnorisis up to 0.4.11. Affected by this issue is the function html of the file PlaylistManager.... | 2026-10-05 |
| CVE-2026-94606 | high | 8.9 | No | authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, authentik email authenticator enrollment during an... | 2026-10-05 |
| CVE-2026-91161 | medium | 6.4 | No | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the GET /api/sessions/{sessionId}/groups/{groupId}/invite-... | 2026-10-05 |
| CVE-2026-91160 | high | 8.2 | No | OpenWA is a free, open source, self-hosted WhatsApp API gateway. Prior to 0.23.5, the /events WebSocket gateway delivers the session.qr even... | 2026-10-05 |
| CVE-2026-77321 | medium | 4.3 | No | TREK is a collaborative travel planner. Prior to 3.3.0, the get_trip_summary tool in server/src/mcp/tools/trips.ts is registered for scoped... | 2026-10-05 |
| CVE-2026-85057 | high | 8.7 | No | ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compati... | 2026-10-05 |
| CVE-2026-79761 | medium | 6.6 | No | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.7.0 until 2.5.1, the Te... | 2026-10-05 |
| CVE-2026-76907 | medium | 6.5 | No | LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 4.8.2 until 5.4.0, GET /api/v1.0/documents/search/ accepts... | 2026-10-05 |
| CVE-2026-52853 | medium | 5.2 | No | Docmost is open-source collaborative wiki and documentation software. Prior to 0.90.1, an authenticated workspace ADMIN can use the workspac... | 2026-10-05 |
| CVE-2026-63645 | high | 7.5 | No | OpenObserve is a cloud-native observability platform. Prior to 0.90.3, OpenObserve registers the /config/runtime endpoint without authentica... | 2026-10-05 |
| CVE-2026-61815 | high | 7.2 | No | zbateson/mail-mime-parser is a mail mime parser alternative to PHP's imap* functions and Pear libraries for reading messages in Internet Mes... | 2026-10-05 |
| CVE-2026-57177 | medium | 4.3 | No | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did not validate OAuth... | 2026-10-05 |
| CVE-2026-57175 | medium | 6.4 | No | Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted SAML responses on th... | 2026-10-05 |
| CVE-2026-56738 | not reported | — | No | phpMyFAQ is an open source FAQ web application. The `StopWords::add()` method inversions prior to 4.1.6 builds a SQL `INSERT` statement usin... | 2026-10-05 |
| CVE-2026-51894 | medium | 6.5 | No | infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap. A reachable path accepts a caller-selected object or te... | 2026-10-05 |
| CVE-2026-48070 | high | 7.1 | No | Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.1, authenticated users can store attacker-controlled ava... | 2026-10-05 |
| CVE-2026-105307 | high | 7.3 | No | A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone... | 2026-10-05 |
| CVE-2026-105224 | medium | 5.4 | No | YesWiki before 4.6.7 contains a cross-site scripting vulnerability in the Bazar valeur action that allows page editors to inject script by r... | 2026-10-05 |
| CVE-2026-105213 | high | 8.2 | No | ZITADEL 4.x before 4.17.1 does not check an organization's inactive state during Login V2 authentication, verifying only the individual user... | 2026-10-05 |