Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61564 | critical | 10.0 | No | AVideo is a video-sharing Platform. Prior to 8.1.0, the unauthenticated installer endpoint `install/checkConfiguration.php` assembles `video... | 2026-10-28 |
| CVE-2026-61546 | not reported | — | No | AnkiMCP is an Anki addon that implements an MCP server, enabling AI assistants to interact with the Anki flashcard application. Prior to ver... | 2026-10-28 |
| CVE-2026-57448 | not reported | — | No | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET... | 2026-10-28 |
| CVE-2026-54455 | high | 7.6 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, ac... | 2026-10-28 |
| CVE-2026-54453 | high | 7.2 | No | OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams. Prior to version 0.10.0, th... | 2026-10-28 |
| CVE-2026-118804 | high | 7.5 | No | Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to access restricted po... | 2026-10-28 |
| CVE-2026-118803 | high | 7.5 | No | Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows anonymous attackers to contro... | 2026-10-28 |
| CVE-2026-118757 | medium | 6.5 | No | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_... | 2026-10-28 |
| CVE-2026-118756 | medium | 5.5 | No | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories o... | 2026-10-28 |
| CVE-2026-118755 | high | 7.2 | No | Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows authenticated users to execute s... | 2026-10-28 |
| CVE-2026-118754 | medium | 5.3 | No | Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php that allows unauthentica... | 2026-10-28 |
| CVE-2026-118753 | high | 7.8 | No | FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows attackers to write past t... | 2026-10-28 |
| CVE-2026-118752 | high | 7.8 | No | FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of PluginIFF.cpp that lacks bou... | 2026-10-28 |
| CVE-2026-118694 | high | 7.5 | No | python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by submitting Markdown wit... | 2026-10-28 |
| CVE-2026-118693 | medium | 4.7 | No | CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embed... | 2026-10-28 |
| CVE-2026-118692 | high | 7.0 | No | CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands... | 2026-10-28 |
| CVE-2026-118691 | low | 3.7 | No | xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenti... | 2026-10-28 |
| CVE-2026-118690 | critical | 9.8 | No | Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to download log a... | 2026-10-28 |
| CVE-2026-118689 | high | 7.5 | No | OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers t... | 2026-10-28 |
| CVE-2026-118682 | high | 7.5 | No | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept... | 2026-10-28 |