Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-55442 | medium | 5.3 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 23.03 to before version... | 2026-10-29 |
| CVE-2026-53921 | critical | 9.8 | No | odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt. Prior to version 25.12, odhcpd's DHCPv6 IA response handler w... | 2026-10-29 |
| CVE-2026-55190 | medium | 6.5 | No | Event Schedule is an open-source platform to share events, sell tickets and bring communities together. In versions 1.0.0 and prior, App\Uti... | 2026-10-29 |
| CVE-2026-55572 | critical | 10.0 | No | e107 is a content management system (CMS). Prior to 2.3.7, the bundled alt_auth plugin's otherdb and e107db authentication backends interpol... | 2026-10-29 |
| CVE-2026-43736 | medium | 5.5 | No | An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27, macOS Tahoe 26.7.2. An app... | 2026-10-29 |
| CVE-2026-46347 | medium | 6.8 | No | The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. Prior to version 26.05, when a passwo... | 2026-10-29 |
| CVE-2026-39902 | high | 7.2 | No | Cacti is an open source performance and fault management framework. Prior to version 1.2.31, the prior blocklist ([;&| `$\\n\r]) omitted sin... | 2026-10-29 |
| CVE-2026-11837 | high | 7.3 | No | A local privilege escalation vulnerability was found in the ansible.posix authorized_key module. The module's keyfile() function uses os.cho... | 2026-10-29 |
| CVE-2026-119050 | high | 8.1 | No | Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke arbitrary pandas functions by... | 2026-10-29 |
| CVE-2026-118425 | medium | 6.8 | No | A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management solution. The issue occur... | 2026-10-29 |
| CVE-2026-116404 | medium | 6.5 | No | Missing Authorization vulnerability in David Anderson Redux Framework redux-framework allows Lifting Sensitive Data Embedded in Cache.This i... | 2026-10-29 |
| CVE-2026-116392 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in PickPlugins Accordion accordions allows Object Injection.This issue affects Accordion: fr... | 2026-10-29 |
| CVE-2026-116391 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in GS Plugins GS Logo Slider gs-logo-slider allows Object Injection.This issue affects GS Lo... | 2026-10-29 |
| CVE-2026-116855 | medium | 5.4 | No | Missing Authorization vulnerability in wphocus My auctions allegro my-auctions-allegro-free-edition allows Exploiting Incorrectly Configured... | 2026-10-29 |
| CVE-2026-116863 | critical | 9.6 | No | Cross-Site Request Forgery (CSRF) vulnerability in Tribulant Software Newsletters newsletters-lite allows Cross Site Request Forgery.This is... | 2026-10-29 |
| CVE-2026-116390 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Ob... | 2026-10-29 |
| CVE-2026-116389 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object Injection.This issue aff... | 2026-10-29 |
| CVE-2026-115957 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Board WP Discussion Boar... | 2026-10-29 |
| CVE-2026-115609 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid invoicing allows Store... | 2026-10-29 |
| CVE-2026-115607 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crowd Favorite DXP ToolKit dxp-toolkit... | 2026-10-29 |