Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111883 | medium | 5.4 | No | Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows remote attackers to stop load tests or reset statistic... | 2026-10-22 |
| CVE-2026-111991 | medium | 6.3 | No | A security vulnerability has been detected in WongKinYiu yolov9 0.1. This vulnerability affects the function DetectMultiBackend.__init__ of... | 2026-10-22 |
| CVE-2026-111986 | medium | 6.3 | No | A vulnerability was determined in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. Affected is the function get_obj_from_str of the file m... | 2026-10-22 |
| CVE-2026-112005 | high | 7.7 | No | WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by... | 2026-10-22 |
| CVE-2026-112000 | high | 7.6 | No | Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe... | 2026-10-22 |
| CVE-2026-107081 | critical | 9.8 | No | SQL injection via identifier injection in the tableName and tableFields POST parameters of admin AJAX endpoints (admin/AJAX_lookup_handler.p... | 2026-10-22 |
| CVE-2026-111877 | medium | 4.3 | No | A vulnerability was determined in dext34-morgan Books4Cash up to a8d3e357db75c07ac5ffbadcbaee2aeb4db3e571. This affects an unknown part of t... | 2026-10-22 |
| CVE-2026-111873 | high | 7.3 | No | A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the fu... | 2026-10-22 |
| CVE-2026-111869 | medium | 5.3 | No | A vulnerability was identified in makeplane plane up to 1.4.2. Impacted is an unknown function of the component API Endpoint. Such manipulat... | 2026-10-22 |
| CVE-2026-87910 | not reported | — | No | When tarfile extracts a link on a system that doesn't support links, it falls back to extracting a member from the archive. In this case, th... | 2026-10-22 |
| CVE-2026-98146 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain struc... | 2026-10-22 |
| CVE-2026-106053 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-21 |
| CVE-2026-55796 | medium | 6.5 | No | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report cons... | 2026-10-21 |
| CVE-2026-96620 | not reported | — | No | Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token withou... | 2026-10-21 |
| CVE-2026-59970 | high | 7.7 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrato... | 2026-10-21 |
| CVE-2026-111921 | medium | 5.4 | No | Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write permission to delete ad... | 2026-10-21 |
| CVE-2026-111916 | medium | 5.3 | No | Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view role-restricted weblink... | 2026-10-21 |
| CVE-2026-111910 | medium | 6.5 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in attachment.php that allows attacke... | 2026-10-21 |
| CVE-2026-111905 | medium | 6.0 | No | phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an insecure direct object reference vulnerability in GET /admin/api/u... | 2026-10-21 |
| CVE-2026-111900 | medium | 4.3 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an improper authorization vulnerability in attachment.php that fails to ver... | 2026-10-21 |