Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100737 | medium | 4.9 | No | Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd. A user who can log in to... | 2026-10-20 |
| CVE-2026-105297 | high | 7.5 | No | Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its own 16 MiB decoded... | 2026-10-20 |
| CVE-2026-103038 | not reported | — | No | PingTools Network Utilities 4.64 contains an OS command injection vulnerability in the Host field of a Watcher ICMP service. The application... | 2026-10-20 |
| CVE-2024-2323 | medium | 4.8 | No | The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history validation feature is en... | 2026-10-20 |
| CVE-2026-97162 | critical | 9.8 | No | Joomla Extension - lomart.fr - Various SQL injection vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-113703 | critical | 9.3 | No | SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where enforce_authentication... | 2026-10-20 |
| CVE-2026-113612 | medium | 5.4 | No | SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food varia... | 2026-10-20 |
| CVE-2026-113610 | medium | 5.4 | No | Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that allows low-privileged au... | 2026-10-20 |
| CVE-2026-113599 | medium | 5.4 | No | Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to create auto-reply message... | 2026-10-20 |
| CVE-2026-113597 | medium | 5.4 | No | Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows authenticated users to re... | 2026-10-20 |
| CVE-2026-113594 | medium | 5.4 | No | Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by... | 2026-10-20 |
| CVE-2026-113358 | high | 7.5 | No | LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to dow... | 2026-10-20 |
| CVE-2026-113357 | low | 3.5 | No | @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports... | 2026-10-20 |
| CVE-2026-113352 | high | 7.5 | No | uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file... | 2026-10-20 |
| CVE-2026-112148 | not reported | — | No | A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an... | 2026-10-20 |
| CVE-2026-77938 | medium | 6.5 | No | Letta through 0.16.8 contains an information disclosure vulnerability that allows users running tools to read server secrets because LocalSa... | 2026-10-20 |
| CVE-2026-77937 | high | 8.1 | No | Letta through 0.16.8 contains an authentication bypass vulnerability that allows API callers to impersonate other users by supplying a self-... | 2026-10-20 |
| CVE-2026-77926 | high | 8.8 | No | Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating system commands throu... | 2026-10-20 |
| CVE-2026-109443 | high | 8.8 | No | JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run operating system commands via... | 2026-10-20 |
| CVE-2026-109442 | critical | 9.8 | No | piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST /chat and POST /chat/stre... | 2026-10-20 |