Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103538 | medium | 6.5 | No | A security flaw has been discovered in ZongXR SuperMarket 1.0.0.0. Affected by this issue is the function OrderController.deleteOrder of the... | 2026-10-01 |
| CVE-2026-103590 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. A... | 2026-10-01 |
| CVE-2026-103290 | low | 3.8 | No | Ghost versions 6.14.0 through versions prior to 6.27.0 contain a path traversal vulnerability in the ImageSize service. Insufficient input v... | 2026-10-01 |
| CVE-2026-103282 | medium | 4.3 | No | Ghost versions 0.5.0 before 6.23.0 contain a concurrency issue in the staff invitation acceptance mechanism that allows multiple accounts to... | 2026-10-01 |
| CVE-2026-103278 | high | 7.3 | No | Ghost versions 5.8.0 before 6.34.0 contain an input validation vulnerability in the admin iframe that allows attackers to take over staff us... | 2026-10-01 |
| CVE-2026-103533 | medium | 4.1 | No | A vulnerability was found in David-Crty databasement up to 1.7.1. This impacts the function https:/github.com/David-Crty/databasement/pull/5... | 2026-10-01 |
| CVE-2026-103530 | high | 7.3 | No | A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGu... | 2026-10-01 |
| CVE-2026-103274 | medium | 5.3 | No | Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read c... | 2026-10-01 |
| CVE-2026-103269 | medium | 5.3 | No | Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerp... | 2026-10-01 |
| CVE-2026-103261 | medium | 5.3 | No | Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause even... | 2026-10-01 |
| CVE-2026-103257 | high | 7.7 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the n8n node... | 2026-10-01 |
| CVE-2026-103249 | high | 7.6 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit... | 2026-10-01 |
| CVE-2026-103245 | medium | 5.3 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 fail to verify the x-webflow-signature HMAC in the Web... | 2026-10-01 |
| CVE-2026-102278 | high | 7.5 | No | The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to 1.1.20, 2.1.6, 3.0.8, and 5.0.11, de... | 2026-10-01 |
| CVE-2026-101916 | high | 7.4 | No | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, getAuthContex... | 2026-10-01 |
| CVE-2026-101915 | low | 3.7 | No | @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.13.6 and 1.14.5, when an appli... | 2026-10-01 |
| CVE-2026-101911 | not reported | — | No | ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.7.1, the Address6 constructor, Addre... | 2026-10-01 |
| CVE-2026-101909 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 0.28.0 until 0.34.0 and 1.15.1 until 1.20.0, ToFormData processes inh... | 2026-10-01 |
| CVE-2026-101905 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js su... | 2026-10-01 |
| CVE-2026-101901 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Http2Sessions does not install adequate error ha... | 2026-10-01 |