Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112868 | medium | 4.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in H5P H5P h5p allows Exploiting Incorrectly Configured Access Control Securi... | 2026-10-22 |
| CVE-2026-111851 | high | 7.6 | No | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal Elementor Addons royal-ele... | 2026-10-22 |
| CVE-2026-96596 | not reported | — | No | Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Erlang OTP stdlib (erl_tar module), hexpm hex_core (hex_erl_tar modu... | 2026-10-22 |
| CVE-2026-86332 | medium | 6.5 | No | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes... | 2026-10-22 |
| CVE-2026-112309 | high | 7.5 | No | @rvf/set-get before 7.0.4 contains a prototype pollution vulnerability in setPath that allows unauthenticated attackers to overwrite propert... | 2026-10-22 |
| CVE-2026-112304 | high | 7.5 | No | docTR through 1.1.0 contains an unsafe deserialization vulnerability in load_pretrained_params() that loads checkpoints with torch.load with... | 2026-10-22 |
| CVE-2026-112157 | low | 3.1 | No | A weakness has been identified in MemTensor memmy-agent up to 1.0.9/1.1.1/1.2.2. The impacted element is the function requireAdminWrite of t... | 2026-10-22 |
| CVE-2026-111056 | not reported | — | No | FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated POST /api/guest/client/cre... | 2026-10-22 |
| CVE-2026-113406 | high | 8.8 | No | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t... | 2026-10-22 |
| CVE-2026-113405 | high | 8.8 | No | BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements t... | 2026-10-22 |
| CVE-2026-112329 | medium | 4.3 | No | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the legacy save_new_message handler hooked o... | 2026-10-22 |
| CVE-2026-112293 | medium | 5.4 | No | BoxyHQ Enterprise SaaS Starter Kit through 1.6.0 contains a missing authorization vulnerability that allows non-owner team members to manage... | 2026-10-22 |
| CVE-2026-112288 | low | 3.3 | No | Krayin CRM 2.2.5 before 2.2.7 contains a server-side request forgery filter bypass that allows users with webhook permissions to reach inter... | 2026-10-22 |
| CVE-2026-112150 | high | 7.3 | No | A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unk... | 2026-10-22 |
| CVE-2026-112283 | medium | 5.5 | No | VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in _parse_extent_start_points() in clpi_parse.c th... | 2026-10-22 |
| CVE-2026-112278 | medium | 6.5 | No | rdesktop through 1.9.0 contains a heap out-of-bounds read vulnerability in process_raw_bmpcache() in orders.c that allows malicious RDP serv... | 2026-10-22 |
| CVE-2026-112273 | medium | 5.3 | No | libtins through 4.6 contains a heap out-of-bounds read vulnerability in DNS::compose_name in src/dns.cpp that allows remote attackers to rea... | 2026-10-22 |
| CVE-2026-112268 | medium | 6.3 | No | sglang-router (sgl-model-gateway) through 0.3.2 contains an authorization bypass vulnerability that allows holders of the data-plane API key... | 2026-10-22 |
| CVE-2026-112263 | high | 7.8 | No | Television (tv) 0.15.0 through 0.15.9 contains an OS command injection vulnerability that allows attackers to run shell commands through imp... | 2026-10-22 |
| CVE-2026-112145 | high | 7.3 | No | A security vulnerability has been detected in speaches-ai speaches up to 0.9.0-rc.3. This vulnerability affects the function PyannoteDiariza... | 2026-10-22 |