Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-83398 | high | 8.2 | No | Vulnerability in the Oracle Data Integrator product of Oracle Fusion Middleware (component: Data Transforms). Supported versions that are af... | 2026-10-27 |
| CVE-2026-28167 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WebRehab Super Forms super-forms allows Path... | 2026-10-27 |
| CVE-2026-116826 | medium | 6.8 | No | YesWiki before 4.7.0 contains a server-side request forgery vulnerability in DuplicationManager::downloadFile() that allows authenticated ad... | 2026-10-27 |
| CVE-2026-116822 | medium | 5.3 | No | YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers to select arbitrary t... | 2026-10-27 |
| CVE-2026-116818 | high | 8.2 | No | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through... | 2026-10-27 |
| CVE-2026-116813 | medium | 6.5 | No | OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share... | 2026-10-27 |
| CVE-2026-116809 | medium | 5.3 | No | OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows unauthenticated attackers... | 2026-10-27 |
| CVE-2026-116805 | medium | 4.3 | No | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain argon2id hashes of... | 2026-10-27 |
| CVE-2026-116746 | medium | 5.3 | No | QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview AJAX action that allows... | 2026-10-27 |
| CVE-2026-116734 | low | 3.7 | No | flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers verifier because its overflo... | 2026-10-27 |
| CVE-2026-116620 | high | 7.3 | No | A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream>::Take in t... | 2026-10-27 |
| CVE-2026-116604 | medium | 6.5 | No | A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file ad... | 2026-10-27 |
| CVE-2026-116587 | high | 7.5 | No | Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web En... | 2026-10-27 |
| CVE-2026-116583 | not reported | — | No | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.... | 2026-10-27 |
| CVE-2026-116556 | low | 2.4 | No | A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/components/features/annotati... | 2026-10-27 |
| CVE-2026-116515 | medium | 6.3 | No | A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.... | 2026-10-27 |
| CVE-2026-116507 | medium | 5.3 | No | A vulnerability was identified in TOTOLINK A950RG 4.1.2cu.5268_B20221104. Affected by this vulnerability is the function getLanguageCfg of t... | 2026-10-27 |
| CVE-2026-116504 | critical | 9.9 | No | A vulnerability has been found in TOTOLINK A950RG 4.1.2cu.5268_B20221104. This affects the function setCloudUpgradeFW of the file lib/cste_m... | 2026-10-27 |
| CVE-2026-116479 | medium | 4.3 | No | A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler... | 2026-10-27 |
| CVE-2026-115927 | medium | 5.3 | No | Tornado is a Python web framework and asynchronous networking library. Prior to 6.6.0, Tornado decodes HTTP/1.1 chunked transfer encoding by... | 2026-10-27 |