Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108396 | high | 7.0 | No | Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privile... | 2026-10-23 |
| CVE-2026-19754 | not reported | — | No | Baserow versions 2.2.0 through 2.3.3 contain an SQL injection vulnerability in the index() formula function. A low-privileged authenticated... | 2026-10-23 |
| CVE-2026-113876 | medium | 4.3 | No | SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions. A user with CREATE but not READ permissions could... | 2026-10-23 |
| CVE-2026-113875 | low | 3.1 | No | On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation permissions, they may be abl... | 2026-10-23 |
| CVE-2026-113874 | high | 8.1 | No | SmileCDR HAPI FHIR allows an untrusted bundle body to replace a partition identity previously established by a trusted source, and does not... | 2026-10-23 |
| CVE-2026-113873 | high | 7.5 | No | SmileCDR HAPI FHIR does not properly handle highly compressed data, allowing an unauthenticated attacker to send compressed payloads that ex... | 2026-10-23 |
| CVE-2026-111633 | high | 8.6 | No | ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST API JWT bearer token... | 2026-10-23 |
| CVE-2026-111628 | medium | 5.0 | No | 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to instantiate PHP objects b... | 2026-10-23 |
| CVE-2026-111623 | medium | 5.6 | No | Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain vali... | 2026-10-23 |
| CVE-2026-111618 | medium | 5.3 | No | CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article archive download endpoi... | 2026-10-23 |
| CVE-2026-111613 | high | 7.5 | No | AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open arbitrary database conne... | 2026-10-23 |
| CVE-2026-111608 | medium | 4.2 | No | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to delete other mer... | 2026-10-23 |
| CVE-2026-111603 | medium | 4.3 | No | PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated students to access depa... | 2026-10-23 |
| CVE-2026-109219 | critical | 9.8 | No | The Mang Board plugin for WordPress is vulnerable to Arbitrary File Upload in version 2.4.4 via the mbw_file_upload function. This is due to... | 2026-10-23 |
| CVE-2026-10534 | critical | 9.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to buffer overflow in the IXF IMPORT parser. | 2026-10-23 |
| CVE-2026-13433 | critical | 9.6 | No | IBM i Access Client Solutions 1.1.2.0 through 1.1.9.13 (ACS) is vulnerable to downloading unverified product code when configured to update... | 2026-10-23 |
| CVE-2026-10543 | critical | 9.8 | No | IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation with a specially crafted query. | 2026-10-23 |
| CVE-2026-17111 | critical | 9.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow... | 2026-10-23 |
| CVE-2026-17276 | critical | 9.9 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handlin... | 2026-10-23 |
| CVE-2026-16860 | critical | 9.9 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path elemen... | 2026-10-23 |