Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116206 | medium | 6.4 | No | YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into c... | 2026-10-29 |
| CVE-2026-116202 | medium | 5.4 | No | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitize... | 2026-10-29 |
| CVE-2026-116198 | medium | 4.3 | No | Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagge... | 2026-10-29 |
| CVE-2026-116194 | medium | 6.8 | No | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which... | 2026-10-29 |
| CVE-2026-116190 | low | 3.7 | No | rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured... | 2026-10-29 |
| CVE-2026-116186 | not reported | — | No | OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events... | 2026-10-29 |
| CVE-2026-116182 | medium | 5.0 | No | phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images reference... | 2026-10-29 |
| CVE-2026-116174 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that... | 2026-10-29 |
| CVE-2026-116170 | medium | 4.9 | No | SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op an... | 2026-10-29 |
| CVE-2026-116166 | medium | 6.8 | No | SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API... | 2026-10-29 |
| CVE-2026-116162 | not reported | — | No | Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-... | 2026-10-29 |
| CVE-2026-116142 | low | 3.3 | No | ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printi... | 2026-10-29 |
| CVE-2026-116137 | low | 3.7 | No | adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonical... | 2026-10-29 |
| CVE-2026-116098 | high | 7.8 | No | A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component R... | 2026-10-29 |
| CVE-2026-116095 | medium | 5.3 | No | A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of t... | 2026-10-29 |
| CVE-2026-116062 | high | 7.3 | No | A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the fi... | 2026-10-29 |
| CVE-2026-116058 | medium | 6.3 | No | A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file... | 2026-10-29 |
| CVE-2026-116055 | medium | 6.3 | No | A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/d... | 2026-10-29 |
| CVE-2026-115605 | medium | 4.3 | No | Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured Access Control Security L... | 2026-10-29 |
| CVE-2026-114181 | medium | 5.3 | No | Missing Authorization vulnerability in Magepeople inc. Taxi Booking Manager for WooCommerce ecab-taxi-booking-manager allows Exploiting Inco... | 2026-10-29 |