Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118757 | medium | 6.5 | No | PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization vulnerability in the update_... | 2026-10-29 |
| CVE-2026-118756 | medium | 5.5 | No | gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to delete directories o... | 2026-10-29 |
| CVE-2026-118693 | medium | 4.7 | No | CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that trusts unvalidated embed... | 2026-10-29 |
| CVE-2026-118692 | high | 7.0 | No | CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows attackers to execute commands... | 2026-10-29 |
| CVE-2026-118691 | low | 3.7 | No | xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint that allows unauthenti... | 2026-10-29 |
| CVE-2026-118689 | high | 7.5 | No | OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows unauthenticated attackers t... | 2026-10-29 |
| CVE-2026-118682 | high | 7.5 | No | KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept... | 2026-10-29 |
| CVE-2026-61542 | high | 8.6 | No | Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server. Gearsystem, the affected compon... | 2026-10-29 |
| CVE-2026-118685 | medium | 6.5 | No | ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the string signup setting '... | 2026-10-29 |
| CVE-2026-58458 | medium | 6.5 | No | Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the native persistent-string d... | 2026-10-29 |
| CVE-2026-59979 | high | 8.3 | No | YosemiteCrew provides organization-based service and task management. In the source-reported affected main and dev snapshots, YosemiteCrew's... | 2026-10-29 |
| CVE-2026-44179 | critical | 9.9 | No | XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence. From 1.13 until 1.14.5, the `exc... | 2026-10-29 |
| CVE-2026-96951 | high | 8.8 | Listed | Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypa... | 2026-10-29 |
| CVE-2026-96202 | high | 8.8 | No | Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network. | 2026-10-29 |
| CVE-2026-93903 | not reported | — | No | LiteSpeed Web Server (LSWS) before 6.3.7 build 1 mishandles internal redirect URL validation in a certain "corner case." | 2026-10-29 |
| CVE-2026-88094 | high | 8.1 | No | Improper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an author... | 2026-10-29 |
| CVE-2019-25781 | high | 7.5 | No | Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows remote attackers to e... | 2026-10-29 |
| CVE-2026-49142 | high | 8.8 | No | OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clini... | 2026-10-29 |
| CVE-2026-119028 | high | 8.8 | No | oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by supplying non-literal enu... | 2026-10-29 |
| CVE-2026-119025 | high | 7.5 | No | open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell code by supplying crafte... | 2026-10-29 |