Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116388 | medium | 5.3 | No | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-10-26 |
| CVE-2026-115598 | medium | 5.3 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-26 |
| CVE-2026-115597 | medium | 5.4 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-26 |
| CVE-2026-114710 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery PhotoBlocks photobloc... | 2026-10-26 |
| CVE-2026-116394 | medium | 5.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc. WpEvently mage-eventpress all... | 2026-10-26 |
| CVE-2026-116282 | medium | 4.3 | No | A security flaw has been discovered in Kameleo up to 5.3.1. Affected by this issue is the function CookieController.ListCookies of the file... | 2026-10-26 |
| CVE-2026-82389 | medium | 6.5 | No | In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in subsys/bluetooth/host/classic/hfp_ag.c starts an SDP disc... | 2026-10-26 |
| CVE-2026-82388 | medium | 5.3 | No | bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with hfp_hf_create(), which... | 2026-10-26 |
| CVE-2026-115883 | not reported | — | No | LangGraph checkpoint savers provide Postgres- and SQLite-backed state persistence for LangGraph workflows and agents. Prior to langgraph-che... | 2026-10-26 |
| CVE-2026-93441 | high | 8.6 | No | IBM QRadar SIEM could allow a remote attacker to cause a denial of service due to uncontrolled resource consumption. | 2026-10-26 |
| CVE-2026-65825 | high | 7.5 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. In versions 2.1.0 and prior, a r... | 2026-10-26 |
| CVE-2026-52167 | medium | 6.2 | No | A stack overflow in the gensub_ParsePsb() function of AOC LC32D1320 v2.05 allows attackers to cause a Denial of Service (DoS) via supplying... | 2026-10-26 |
| CVE-2026-50787 | high | 7.5 | No | e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in restrito/inc/captcha.php. The appl... | 2026-10-26 |
| CVE-2026-116497 | medium | 5.5 | No | A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field... | 2026-10-26 |
| CVE-2026-116049 | high | 7.3 | No | A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the... | 2026-10-26 |
| CVE-2026-116046 | medium | 5.3 | No | A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of t... | 2026-10-26 |
| CVE-2026-116019 | high | 8.8 | No | Grav 2.0.15 before 2.2.13 contains an allowlist bypass vulnerability that allows page editors to invoke arbitrary public static methods by r... | 2026-10-26 |
| CVE-2026-116015 | medium | 4.3 | No | yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that allows authenticated me... | 2026-10-26 |
| CVE-2026-116007 | low | 3.7 | No | A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateS... | 2026-10-26 |
| CVE-2026-116000 | high | 7.3 | No | A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file... | 2026-10-26 |