Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118378 | high | 7.8 | No | Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements b... | 2026-10-28 |
| CVE-2026-117606 | medium | 5.4 | No | NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' regist... | 2026-10-28 |
| CVE-2026-115624 | medium | 5.3 | No | GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user wi... | 2026-10-28 |
| CVE-2026-115207 | medium | 5.5 | No | A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or... | 2026-10-28 |
| CVE-2026-114730 | high | 7.2 | No | Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blockl... | 2026-10-28 |
| CVE-2026-114722 | medium | 6.5 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() d... | 2026-10-28 |
| CVE-2026-114661 | high | 8.5 | No | OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any authenticated user t... | 2026-10-28 |
| CVE-2026-114657 | medium | 5.7 | No | Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture visitors' HTTP Basic crede... | 2026-10-28 |
| CVE-2026-114640 | high | 8.7 | No | Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX provider that forwards cl... | 2026-10-28 |
| CVE-2026-114636 | high | 8.7 | No | Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the HTTP router generated f... | 2026-10-28 |
| CVE-2026-114577 | high | 7.3 | No | A vulnerability was found in oretnom23 php-travel-agency-system. This vulnerability affects unknown code of the file admin/insert.php of the... | 2026-10-28 |
| CVE-2026-114714 | medium | 5.3 | No | Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. Wi... | 2026-10-28 |
| CVE-2026-109848 | medium | 4.2 | No | GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled... | 2026-10-28 |
| CVE-2026-114574 | medium | 4.3 | No | A security vulnerability has been detected in massCodeIO massCode 5.10. Affected is an unknown function of the file src/main/api/index.ts of... | 2026-10-28 |
| CVE-2026-105272 | medium | 4.2 | No | GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controll... | 2026-10-28 |
| CVE-2026-96778 | high | 8.8 | No | Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker()... | 2026-10-28 |
| CVE-2026-96641 | medium | 6.5 | No | Pillow is a Python imaging library. Prior to 13.0.0, PILfont text-width accumulation in src/_imaging.c checks positive glyph advances agains... | 2026-10-28 |
| CVE-2026-114439 | high | 7.3 | No | A vulnerability was determined in oretnom23 php-travel-agency-system. Affected by this issue is some unknown functionality of the file admin... | 2026-10-28 |
| CVE-2026-96640 | high | 7.5 | No | Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages gra... | 2026-10-28 |
| CVE-2026-29001 | high | 7.2 | No | TastyIgniter through 4.4.5 contain a PHP object injection vulnerability that allows authenticated administrators to achieve arbitrary code e... | 2026-10-28 |