Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115546 | high | 8.1 | No | Okta Access Gateway (OAG) does not validate the selected authentication source during sign-on. An authenticated user with an active session... | 2026-10-23 |
| CVE-2026-115449 | low | 3.5 | No | A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the h... | 2026-10-23 |
| CVE-2026-55459 | high | 7.4 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.01 to before version... | 2026-10-23 |
| CVE-2026-115481 | not reported | — | No | baserCMS is a website development framework. Starting in version 5.0.0-beta1 and prior to versions 5.3.2 and 5.4.2, `PermissionGroupsService... | 2026-10-23 |
| CVE-2026-114623 | medium | 6.5 | No | baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, an authenticated user with only theme-fi... | 2026-10-23 |
| CVE-2026-113792 | not reported | — | No | pypdf is a free and open-source pure-python PDF library. Prior to 6.20.1, calling PdfWriter.find_outline_item on a crafted PDF with a cyclic... | 2026-10-23 |
| CVE-2026-113788 | not reported | — | No | Lagoon is an application delivery platform for Kubernetes. Versions prior to 2.33.1 have a vulnerability in the `ssh` service in Lagoon core... | 2026-10-23 |
| CVE-2026-111663 | high | 8.6 | No | Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to fetch arbitrary URLs via... | 2026-10-23 |
| CVE-2016-20104 | high | 7.5 | No | EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers t... | 2026-10-23 |
| CVE-2015-20128 | high | 8.2 | No | FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate MSSQL queries throu... | 2026-10-23 |
| CVE-2014-125133 | high | 7.5 | No | NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated attackers to download arbi... | 2026-10-23 |
| CVE-2026-111658 | low | 3.8 | No | SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows site-scoped administrators t... | 2026-10-23 |
| CVE-2012-20003 | medium | 6.1 | No | Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attacker... | 2026-10-23 |
| CVE-2026-55862 | medium | 6.5 | No | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.0, multiple ixml DOM traversal functions process... | 2026-10-23 |
| CVE-2026-57486 | high | 7.5 | No | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes th... | 2026-10-23 |
| CVE-2026-57487 | high | 7.5 | No | pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, Transfer-Encoding: chunked causes the HTTP pa... | 2026-10-23 |
| CVE-2026-112857 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue affects Reprizo: from n/a... | 2026-10-23 |
| CVE-2026-112853 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue affects Hallelujah:... | 2026-10-23 |
| CVE-2026-112849 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes Hostme v2 hostmev2 allows... | 2026-10-23 |
| CVE-2026-112862 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows Object Injection.This i... | 2026-10-23 |