Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116818 | high | 8.2 | No | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through... | 2026-10-27 |
| CVE-2026-116813 | medium | 6.5 | No | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share... | 2026-10-27 |
| CVE-2026-116809 | medium | 5.3 | No | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers... | 2026-10-27 |
| CVE-2026-116805 | medium | 4.3 | No | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of... | 2026-10-27 |
| CVE-2026-116746 | medium | 5.3 | No | QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows... | 2026-10-27 |
| CVE-2026-116734 | low | 3.7 | No | flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflo... | 2026-10-27 |
| CVE-2026-116620 | high | 7.3 | No | A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream>::Take in t... | 2026-10-27 |
| CVE-2026-116604 | medium | 6.5 | No | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file ad... | 2026-10-27 |
| CVE-2026-116587 | high | 7.5 | No | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En... | 2026-10-27 |
| CVE-2026-116583 | not reported | — | No | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.... | 2026-10-27 |
| CVE-2026-116556 | low | 2.4 | No | A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotati... | 2026-10-27 |
| CVE-2026-116515 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.... | 2026-10-27 |
| CVE-2026-116507 | medium | 5.3 | No | A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of t... | 2026-10-27 |
| CVE-2026-116504 | critical | 9.9 | No | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_m... | 2026-10-27 |
| CVE-2026-116479 | medium | 4.3 | No | A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler... | 2026-10-27 |
| CVE-2026-115927 | medium | 5.3 | No | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by... | 2026-10-27 |
| CVE-2026-69986 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-27 |
| CVE-2026-18415 | high | 7.1 | No | ieee802154_send() in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer (tx_frame... | 2026-10-27 |
| CVE-2026-106174 | high | 7.5 | No | A improper locking vulnerability in Fortinet FortiOS 8.0.0, FortiOS 7.6.4 through 7.6.6 may allow an unauthenticated attacker with network a... | 2026-10-27 |
| CVE-2026-76654 | medium | 5.8 | No | An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a symbolic link that poin... | 2026-10-27 |