Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115347 | high | 7.5 | No | Mistune before 3.3.0 contains an inefficient algorithmic complexity vulnerability in parse_link_text that allows remote attackers to cause d... | 2026-10-26 |
| CVE-2026-114459 | low | 3.7 | No | A flaw was found in mod_qos. When inspecting HTTP response bodies, improper boundary checking can cause the module to read memory outside al... | 2026-10-26 |
| CVE-2026-114458 | medium | 5.9 | No | A flaw was found in mod_qos. An unauthenticated remote attacker can cause a Denial of Service (DoS) by maintaining numerous concurrent low-r... | 2026-10-26 |
| CVE-2026-114457 | low | 3.7 | No | A flaw was found in mod_qos. An unauthenticated remote attacker could cause a Denial of Service (DoS) by sending a specially crafted JSON re... | 2026-10-26 |
| CVE-2026-112955 | medium | 6.5 | No | ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, an authenticated importer can... | 2026-10-26 |
| CVE-2026-110205 | high | 8.8 | No | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed ne... | 2026-10-26 |
| CVE-2026-110127 | medium | 4.3 | No | waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability in the mobile CartController that allows authenticate... | 2026-10-26 |
| CVE-2026-110122 | medium | 4.3 | No | PickMall lilishop through 4.4 contains an insecure direct object reference vulnerability that allows authenticated sellers to change other s... | 2026-10-26 |
| CVE-2026-110117 | medium | 6.5 | No | SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged... | 2026-10-26 |
| CVE-2026-110110 | medium | 4.3 | No | JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disab... | 2026-10-26 |
| CVE-2026-110105 | medium | 5.3 | No | B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes beca... | 2026-10-26 |
| CVE-2026-110100 | medium | 5.4 | No | Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days... | 2026-10-26 |
| CVE-2026-109966 | medium | 5.3 | No | yt-dlp-web-ui through 4.0.0 contains an argument injection vulnerability that allows unauthenticated remote attackers to inject yt-dlp optio... | 2026-10-26 |
| CVE-2026-109961 | high | 8.5 | No | Froxlor 0.10.0 before 2.3.14 contains a newline injection vulnerability that allows authenticated customers to inject arbitrary entries into... | 2026-10-26 |
| CVE-2026-109956 | high | 7.0 | No | NLTK through 3.10.3 contains a path traversal vulnerability in WekaClassifier that allows attackers to bypass nltk.pathsec containment by su... | 2026-10-26 |
| CVE-2026-109783 | high | 8.3 | No | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. | 2026-10-26 |
| CVE-2026-109782 | high | 8.3 | No | Mitigation bypass in the File Handling component. This vulnerability was fixed in Firefox ESR 153.5 and Thunderbird 153.5. | 2026-10-26 |
| CVE-2026-109780 | critical | 9.8 | No | Mitigation bypass in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-26 |
| CVE-2026-109428 | high | 8.8 | No | Mistral Vibe before 2.25.5 contains a permission validation bypass vulnerability that allows attackers to execute unauthorized commands by e... | 2026-10-26 |
| CVE-2026-109774 | critical | 9.8 | No | Invalid pointer, undefined behavior in the DOM: Notifications component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-26 |