Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109441 | medium | 5.8 | No | LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers on Docker's shared def... | 2026-10-20 |
| CVE-2026-97163 | critical | 9.8 | No | Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29 | 2026-10-20 |
| CVE-2026-105772 | not reported | — | No | Path Traversal (CWE-22) in FileArtifactService in Google ADK TypeScript (@google/adk) versions 0.4.0 before 0.6.0 allows a remote unauthenti... | 2026-10-20 |
| CVE-2026-92539 | medium | 6.7 | No | A service account with user-management permissions in one organization can read, modify, disable or delete users belonging to other organiza... | 2026-10-20 |
| CVE-2026-113681 | medium | 5.5 | No | OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in cineon::Codec::Read that... | 2026-10-20 |
| CVE-2026-113679 | high | 7.0 | No | HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper because the font_glyph_to... | 2026-10-20 |
| CVE-2026-113607 | medium | 6.5 | No | Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows authenticated users to read re... | 2026-10-20 |
| CVE-2026-113605 | high | 7.2 | No | Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that allows administrators to... | 2026-10-20 |
| CVE-2026-113604 | medium | 5.5 | No | Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that allocates arrays sized by unv... | 2026-10-20 |
| CVE-2026-113602 | medium | 5.3 | No | json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode trailing-data checks b... | 2026-10-20 |
| CVE-2026-92162 | not reported | — | No | Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems whe... | 2026-10-20 |
| CVE-2026-113356 | high | 7.5 | No | DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft file contents to unseri... | 2026-10-20 |
| CVE-2026-113355 | medium | 4.8 | No | Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by craft... | 2026-10-20 |
| CVE-2026-113353 | medium | 5.4 | No | LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor and admin_question_edi... | 2026-10-20 |
| CVE-2026-113350 | medium | 5.4 | No | react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript... | 2026-10-20 |
| CVE-2026-110180 | medium | 4.8 | No | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions from 2.4.2 through 2.4.7, from 3.1.3 through 3.1.8... | 2026-10-20 |
| CVE-2026-110095 | low | 3.7 | No | fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js. In versions before 2.4.8, from 3.0.0 through 3.1.8, and from 4... | 2026-10-20 |
| CVE-2026-77936 | critical | 9.8 | No | Letta through 0.16.8 ships a compose.yaml that does not enable LETTA_SERVER_SECURE, so the password middleware is never added and all API ro... | 2026-10-20 |
| CVE-2026-77935 | high | 8.3 | No | Coze Studio through 0.5.1 contains an insecure direct object reference vulnerability in workflow.go that allows authenticated users to acces... | 2026-10-20 |
| CVE-2026-77934 | high | 8.8 | No | Coze Studio before 0.5.0 contains an insecure default configuration that allows any registered user to execute commands by running workflow... | 2026-10-20 |