Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114619 | medium | 4.6 | No | Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to 1.9.0, OpenIDImplicitGrant.validate_authorization_reques... | 2026-10-29 |
| CVE-2026-115248 | medium | 5.4 | No | A vulnerability was detected in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This issue affe... | 2026-10-29 |
| CVE-2026-115323 | high | 7.3 | No | EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers... | 2026-10-29 |
| CVE-2026-114665 | medium | 6.5 | No | Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows au... | 2026-10-29 |
| CVE-2026-114615 | high | 7.4 | No | Authlib is a Python library which builds OAuth and OpenID Connect servers. From 1.3.1 until 1.9.0, OctKey.import_key() checks asymmetric-key... | 2026-10-29 |
| CVE-2026-114611 | critical | 9.1 | No | OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile device management. Prior... | 2026-10-29 |
| CVE-2026-114610 | medium | 6.5 | No | fpdf2 is a PDF creation library for Python. From 2.5.0 until 2.8.8, fpdf2's SVGObject.build_xref() passes nested SVG references to GraphicsC... | 2026-10-29 |
| CVE-2026-114609 | medium | 5.8 | No | fpdf2 is a PDF creation library for Python. Prior to 2.8.8, fpdf2's shared image loader automatically dereferences attacker-controlled HTTP(... | 2026-10-29 |
| CVE-2026-114605 | high | 7.5 | No | dnspython is a DNS toolkit for Python. Prior to 2.9.0, dns.name.from_wire_parser follows attacker-controlled DNS compression pointer chains... | 2026-10-29 |
| CVE-2026-114603 | medium | 5.3 | No | OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.1, the opentelemetry-api function TraceState.from_head... | 2026-10-29 |
| CVE-2026-114173 | medium | 5.3 | No | The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public storefront pages. An unauthen... | 2026-10-29 |
| CVE-2026-113409 | medium | 4.8 | No | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripti... | 2026-10-29 |
| CVE-2026-113387 | high | 8.6 | No | The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a secret exposed in public... | 2026-10-29 |
| CVE-2026-113775 | high | 7.8 | No | A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command exposed by the Autodesk F... | 2026-10-29 |
| CVE-2026-111422 | not reported | — | No | In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment` parameter only once, alt... | 2026-10-29 |
| CVE-2026-112904 | high | 8.7 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. In versions 1.0.8.6 and prior, the n... | 2026-10-29 |
| CVE-2026-112332 | high | 7.5 | No | Motor.NET before 0.19.0 contains an uncaught exception vulnerability in JsonNetDeserializer.Deserialize that allows a remote attacker who ca... | 2026-10-29 |
| CVE-2026-109516 | critical | 9.8 | No | The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Account Takeover in all versions... | 2026-10-29 |
| CVE-2026-110541 | high | 7.2 | No | Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 re... | 2026-10-29 |
| CVE-2026-103792 | critical | 9.6 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-10-29 |