Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114659 | medium | 6.5 | No | Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic /api/v1/flex-objects/pages API routes chec... | 2026-10-23 |
| CVE-2026-114634 | medium | 4.3 | No | WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers()... | 2026-10-23 |
| CVE-2026-114607 | critical | 9.1 | No | Better Auth is an authentication and authorization library for TypeScript. From 1.4.0-beta.18 until 1.7.7, deployments that enable Magic Lin... | 2026-10-23 |
| CVE-2026-114515 | medium | 6.5 | No | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior... | 2026-10-23 |
| CVE-2026-114492 | medium | 6.5 | No | gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary... | 2026-10-23 |
| CVE-2026-114145 | high | 7.5 | No | GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py ac... | 2026-10-23 |
| CVE-2026-114137 | high | 7.4 | No | Django REST framework is a toolkit for building Web APIs. From 3.12.0 until 3.18.2, TokenProxy.delete() in rest_framework/authtoken/models.p... | 2026-10-23 |
| CVE-2026-114361 | medium | 5.6 | No | A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Id... | 2026-10-23 |
| CVE-2026-114132 | not reported | — | No | Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro m... | 2026-10-23 |
| CVE-2026-114128 | medium | 6.5 | No | Astro is a web framework for content-driven websites. Prior to 7.3.2, Astro's JSX and MDX rendering pipeline treats string children of scrip... | 2026-10-23 |
| CVE-2026-114124 | low | 3.9 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.6, 43.7.3, 4... | 2026-10-23 |
| CVE-2026-113800 | medium | 5.4 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 4... | 2026-10-23 |
| CVE-2026-112333 | medium | 5.4 | No | GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allow... | 2026-10-23 |
| CVE-2026-113796 | medium | 4.2 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 4... | 2026-10-23 |
| CVE-2026-111678 | low | 3.3 | No | Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts a... | 2026-10-23 |
| CVE-2026-111668 | medium | 5.4 | No | AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows authenticated low-privileged... | 2026-10-23 |
| CVE-2026-110744 | high | 7.2 | No | A flaw was found in multicluster-global-hub-operator-bundle. The operator is configured with overly broad role-based access control (RBAC) p... | 2026-10-23 |
| CVE-2026-104068 | high | 7.2 | No | JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows an authenticated Wor... | 2026-10-23 |
| CVE-2026-100886 | critical | 10.0 | No | A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build202604241011. The affected element is an unknown funct... | 2026-10-23 |
| CVE-2021-48018 | high | 7.4 | No | Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as contract storage variabl... | 2026-10-23 |