Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116544 | low | 3.7 | No | Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealme... | 2026-10-26 |
| CVE-2026-116540 | medium | 5.9 | No | netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_c... | 2026-10-26 |
| CVE-2026-116262 | medium | 5.4 | No | A vulnerability was detected in libimobiledevice up to 1.4.0. The affected element is the function webinspector_receive_with_timeout of the... | 2026-10-26 |
| CVE-2026-116259 | medium | 5.3 | No | A security flaw has been discovered in libimobiledevice up to 1.4.0. This vulnerability affects the function afc_get_device_info_key of the... | 2026-10-26 |
| CVE-2026-116256 | high | 7.3 | No | A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb905. Affected by this vulnerability is the function... | 2026-10-26 |
| CVE-2026-116217 | medium | 6.1 | No | RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/Food_Service/MenuReports.php that allows unauthe... | 2026-10-26 |
| CVE-2026-116213 | medium | 4.9 | No | Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that creates symlinks from theme... | 2026-10-26 |
| CVE-2026-116253 | high | 7.3 | No | A vulnerability was determined in DedeCMS 5.7.118. This vulnerability affects the function common.inc.php::_RunMagicQuotes of the file plus/... | 2026-10-26 |
| CVE-2026-116235 | critical | 9.1 | No | A flaw has been found in Oray Pugongying X5 Pro 7.6.1. Affected by this vulnerability is an unknown functionality of the component L2TP Auth... | 2026-10-26 |
| CVE-2026-116232 | critical | 9.9 | No | A weakness has been identified in Oray Pugongying X5 Pro 7.6.1. This affects the function snmp_set of the component SNMP Handler. Executing... | 2026-10-26 |
| CVE-2026-116229 | low | 3.5 | No | A vulnerability was determined in ffxiv-teamcraft FFXIV Teamcraft up to 11.4.31. Impacted is the function clipboard.readText of the file app... | 2026-10-26 |
| CVE-2026-116224 | medium | 4.3 | No | A vulnerability has been found in fr0tt benotes up to 2.8.1. This affects the function getUrlInfo of the file app/Http/Controllers/PostContr... | 2026-10-26 |
| CVE-2026-116207 | critical | 9.1 | No | YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::pr... | 2026-10-26 |
| CVE-2026-116203 | medium | 6.1 | No | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token v... | 2026-10-26 |
| CVE-2026-116183 | high | 7.5 | No | phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated attackers to modify or delete... | 2026-10-26 |
| CVE-2026-116167 | medium | 6.8 | No | SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page that assigns the to par... | 2026-10-26 |
| CVE-2026-116163 | high | 7.4 | No | Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the validateSetUp, validateLogin, and... | 2026-10-26 |
| CVE-2026-116123 | low | 3.7 | No | A weakness has been identified in NocoDB up to 2026.07.0. The affected element is the function validatePassword of the file /auth/user/signu... | 2026-10-26 |
| CVE-2026-116120 | medium | 5.6 | No | A vulnerability was determined in NocoDB up to 2026.07.0. This vulnerability affects the function UserRefreshToken.deleteAllUserToken of the... | 2026-10-26 |
| CVE-2026-116139 | medium | 5.4 | No | WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated commenters to inject JavaScri... | 2026-10-26 |