Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93571 | not reported | — | No | Szafir is vulnerable to Path Traversal in the uploaded filename. A man-in-the-middle attacker who can reroute update request to their server... | 2026-10-29 |
| CVE-2026-93570 | not reported | — | No | Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injection. When a user signs or verify a crafted XML file contain... | 2026-10-29 |
| CVE-2026-107024 | not reported | — | No | Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard... | 2026-10-29 |
| CVE-2026-107021 | not reported | — | No | Insecure permissions in the CardProvider content provider component of helloworld1 AnyMemo versionCode 20260730 allows unauthorized attacker... | 2026-10-29 |
| CVE-2026-107019 | not reported | — | No | Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows unauthorized attackers to cre... | 2026-10-29 |
| CVE-2026-107018 | not reported | — | No | Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files insid... | 2026-10-29 |
| CVE-2026-107016 | not reported | — | No | Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts. | 2026-10-29 |
| CVE-2026-107014 | not reported | — | No | Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read notes in another user'... | 2026-10-29 |
| CVE-2026-79589 | not reported | — | No | The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an attacker to gain unauthentic... | 2026-10-29 |
| CVE-2026-119054 | medium | 5.4 | No | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users... | 2026-10-29 |
| CVE-2026-119053 | medium | 5.3 | No | lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in snmp_pbuf_stream_writeto() that bounds co... | 2026-10-29 |
| CVE-2026-119051 | medium | 5.9 | No | flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to create huge sparse arr... | 2026-10-29 |
| CVE-2026-119049 | high | 7.6 | No | FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another user's existing mailbo... | 2026-10-29 |
| CVE-2026-118989 | medium | 5.5 | No | WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability in download_remote_f... | 2026-10-29 |
| CVE-2026-42949 | medium | 5.6 | No | A authorization bypass vulnerability exists in the /api/runscript functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP r... | 2026-10-29 |
| CVE-2026-42922 | critical | 9.8 | No | A authorization bypass vulnerability exists in the /nodered functionality of FUXA (version(s): 1.3.2-2809). A specially crafted HTTP request... | 2026-10-29 |
| CVE-2026-40063 | medium | 5.3 | No | A information disclosure vulnerability exists in the /nodered/fuxa/scripts functionality of FUXA (version(s): 1.3.2-2809). A specially craft... | 2026-10-29 |
| CVE-2026-85749 | high | 8.1 | No | MailWatch for MailScanner is a web-based front-end to MailScanner. Prior to 1.2.27, any authenticated MailWatch user, including the U/user,... | 2026-10-29 |
| CVE-2026-75520 | medium | 5.4 | No | Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi. Prior to 2026.3, the `udevices` JSON com... | 2026-10-29 |
| CVE-2026-57448 | not reported | — | No | Blombooru is a self-hosted personal booru for organizing and tagging private image collections. Prior to 1.40.0, the administrator-only `GET... | 2026-10-29 |