Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111894 | medium | 5.4 | No | phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated... | 2026-10-21 |
| CVE-2026-111855 | high | 7.5 | No | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. A path traversal vulnerability exists in the web management interfa... | 2026-10-21 |
| CVE-2026-111802 | medium | 6.6 | No | A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash wit... | 2026-10-21 |
| CVE-2026-111719 | medium | 5.9 | No | Roncoo-pay through commit 9428382 contains a missing authorization vulnerability in F2FPayController.orderQuery that allows unauthenticated... | 2026-10-21 |
| CVE-2026-111714 | low | 3.1 | No | tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to block visitor pages by... | 2026-10-21 |
| CVE-2024-58398 | medium | 4.3 | No | Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in the login page because... | 2026-10-21 |
| CVE-2026-108372 | not reported | — | No | Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until... | 2026-10-21 |
| CVE-2026-111709 | medium | 5.4 | No | WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows authenticated agents to ac... | 2026-10-21 |
| CVE-2026-111704 | critical | 9.8 | No | LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote attackers to access REST... | 2026-10-21 |
| CVE-2026-87876 | low | 3.0 | No | Two case-insensitive comparisons on request-derived usernames outside the main authorization path in CUPS's scheduler (printer ACL validatio... | 2026-10-21 |
| CVE-2026-112912 | low | 2.5 | No | filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the... | 2026-10-21 |
| CVE-2026-111699 | medium | 4.8 | No | Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to impersonate WeChat fans... | 2026-10-21 |
| CVE-2026-111694 | medium | 5.3 | No | qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access /flyflow workflow... | 2026-10-21 |
| CVE-2026-111689 | medium | 4.3 | No | Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user records of any depart... | 2026-10-21 |
| CVE-2026-111684 | high | 8.3 | No | Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to view, issue, and revo... | 2026-10-21 |
| CVE-2026-111679 | medium | 5.4 | No | Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin user to list and cle... | 2026-10-21 |
| CVE-2026-111674 | medium | 4.3 | No | Tbed through 20240319 contains a missing authorization vulnerability that allows any authenticated user to rename other users' images throug... | 2026-10-21 |
| CVE-2026-111669 | medium | 6.5 | No | ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate the ORDER BY clause by... | 2026-10-21 |
| CVE-2026-111664 | medium | 4.4 | No | Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes to force updates by c... | 2026-10-21 |
| CVE-2026-111659 | medium | 6.5 | No | Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to forge orders by calling... | 2026-10-21 |