Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-60111 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-29 |
| CVE-2026-54866 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin | 2026-10-29 |
| CVE-2026-54858 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Printy | 2026-10-29 |
| CVE-2026-54853 | medium | 5.3 | No | Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-29 |
| CVE-2026-61575 | medium | 4.7 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` and stores its filen... | 2026-10-29 |
| CVE-2026-61573 | medium | 6.1 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and JavaScript without o... | 2026-10-29 |
| CVE-2026-57845 | high | 8.8 | No | Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute arbitrary Python cod... | 2026-10-29 |
| CVE-2026-55465 | medium | 5.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 22.04 to before version... | 2026-10-29 |
| CVE-2026-55444 | medium | 5.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, the legacy RS... | 2026-10-29 |
| CVE-2026-55606 | medium | 6.5 | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. In versions 25.12 and prior, odhcpd's DHCPv6 self-loop detect... | 2026-10-29 |
| CVE-2026-51912 | not reported | — | No | OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in main-upload_file-the-preserved-live-upload-file-witness-directly-reaches... | 2026-10-29 |
| CVE-2026-51905 | not reported | — | No | TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/a... | 2026-10-29 |
| CVE-2026-51903 | not reported | — | No | SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.... | 2026-10-29 |
| CVE-2026-51902 | not reported | — | No | SuperAGI up to v0.0.14 contains an improper access control vulnerability. The agent controller endpoint /api/agents/get/project/{project_id}... | 2026-10-29 |
| CVE-2026-51863 | not reported | — | No | DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file (packages/dbgpt-app/src/dbgpt_app/openapi/api_v1/examples_api.py:12... | 2026-10-29 |
| CVE-2026-51851 | not reported | — | No | modelscope agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/file_browser.py:FileBrowser.save_text_f... | 2026-10-29 |
| CVE-2026-48200 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Retrieve... | 2026-10-29 |
| CVE-2026-54455 | high | 7.6 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, ac... | 2026-10-29 |
| CVE-2026-42690 | medium | 5.4 | No | Subscriber Broken Access Control in LearnPress | 2026-10-29 |
| CVE-2026-39737 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor j... | 2026-10-29 |