Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103977 | high | 8.1 | No | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise stores fai... | 2026-10-20 |
| CVE-2026-102985 | medium | 6.5 | No | Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks i... | 2026-10-20 |
| CVE-2026-100352 | high | 7.5 | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.148.0, the OpenAPI 3.1 validation path passes YAML NaN and infinity numer... | 2026-10-20 |
| CVE-2026-92157 | medium | 6.5 | No | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.3.0,... | 2026-10-20 |
| CVE-2026-92150 | high | 7.5 | No | F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0,... | 2026-10-20 |
| CVE-2026-91159 | high | 7.7 | No | Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire at... | 2026-10-20 |
| CVE-2026-91157 | high | 7.5 | No | Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, sites with secure uploads enabled did... | 2026-10-20 |
| CVE-2026-82402 | not reported | — | No | Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target t... | 2026-10-20 |
| CVE-2026-73260 | high | 7.5 | No | Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TLS certificate parser selected by MG_TLS_BUILTIN fails... | 2026-10-20 |
| CVE-2026-55167 | medium | 4.2 | No | LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. Prior to 9... | 2026-10-20 |
| CVE-2026-110773 | medium | 4.3 | No | GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list... | 2026-10-20 |
| CVE-2026-110768 | medium | 4.8 | No | holaOS through 2026.822.1 contains an authorization bypass vulnerability in the channel-gateway Telegram connector that authorizes senders b... | 2026-10-20 |
| CVE-2026-54554 | high | 7.5 | No | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to 1.5.10.1870, the management adInfo() endpoint i... | 2026-10-20 |
| CVE-2026-77524 | critical | 9.9 | No | KEDA is a Kubernetes-based Event Driven Autoscaling component. In version 2.20.2 and earlier, a namespace administrator who can create Trigg... | 2026-10-20 |
| CVE-2026-110763 | medium | 4.3 | No | lamp-boot 4.16.0-java17 through 4.21.2-java17 contains an insecure direct object reference vulnerability in the oauth module's /anyone/findD... | 2026-10-20 |
| CVE-2026-110735 | low | 2.5 | No | Godot Engine through 4.7.2 has a heap out-of-bounds write in the binary resource loader (core/io/resource_format_binary.cpp, ResourceLoaderB... | 2026-10-20 |
| CVE-2026-110719 | high | 7.2 | No | Portkey AI Gateway 1.14.0 through 1.15.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to reach... | 2026-10-20 |
| CVE-2026-110714 | medium | 6.5 | No | libsmb2 through 6.2 contains an integer underflow vulnerability in decode_acl that allows malicious SMB servers to trigger heap out-of-bound... | 2026-10-20 |
| CVE-2026-110659 | medium | 5.5 | No | ELFIO through 3.12 contains a NULL pointer dereference vulnerability in relocation_section_accessor get_entry() that allows attackers to cra... | 2026-10-20 |
| CVE-2026-110654 | medium | 6.1 | No | libzvbi through 0.2.45 contains an out-of-bounds write vulnerability in the Teletext decoder that allows attackers to corrupt memory by supp... | 2026-10-20 |