Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109295 | medium | 4.3 | No | Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall... | 2026-10-23 |
| CVE-2026-109294 | medium | 6.5 | No | Open WebUI from 0.6.42 before 0.11.4 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust... | 2026-10-23 |
| CVE-2026-108358 | not reported | — | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.7, 2.1.19, 2.4.8, 3.10.8, and 5.10.0, XmlScann... | 2026-10-23 |
| CVE-2026-108357 | not reported | — | No | PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. From 3.3.0 until 3.10.8 and 5.10.0, Reader\Xml passes stored... | 2026-10-23 |
| CVE-2026-105945 | not reported | — | No | The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem sto... | 2026-10-23 |
| CVE-2026-109290 | high | 8.7 | No | Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated us... | 2026-10-23 |
| CVE-2026-109287 | medium | 4.3 | No | Open WebUI from 0.9.6 before 0.11.4 contains an authorization flaw where the knowledge base file listing does not verify that a supplied dir... | 2026-10-23 |
| CVE-2026-105944 | not reported | — | No | Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be confi... | 2026-10-23 |
| CVE-2026-105942 | not reported | — | No | When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to aut... | 2026-10-23 |
| CVE-2026-105938 | not reported | — | No | Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which req... | 2026-10-23 |
| CVE-2026-105937 | not reported | — | No | Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The sourc... | 2026-10-23 |
| CVE-2026-105936 | not reported | — | No | The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worke... | 2026-10-23 |
| CVE-2022-51025 | medium | 6.5 | No | Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitr... | 2026-10-23 |
| CVE-2022-51021 | high | 8.2 | No | NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers... | 2026-10-23 |
| CVE-2021-48014 | critical | 9.8 | No | FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that allows unauthenticated... | 2026-10-23 |
| CVE-2019-25778 | high | 8.2 | No | SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by in... | 2026-10-23 |
| CVE-2026-105935 | not reported | — | No | The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the fu... | 2026-10-23 |
| CVE-2026-105934 | not reported | — | No | The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE /admin/v2/persistent/{tenant}/{namespace... | 2026-10-23 |
| CVE-2017-20289 | high | 7.5 | No | Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users... | 2026-10-23 |
| CVE-2026-67208 | critical | 9.8 | No | Juggle through 1.6.0 contains a remote code execution vulnerability that allows unauthenticated remote attackers to execute arbitrary OS com... | 2026-10-23 |