Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109750 | critical | 9.6 | No | Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-19 |
| CVE-2026-104627 | medium | 5.4 | No | The Gitea OpenID association callback in the security settings accepted a positive OpenID 2.0 assertion without checking that the signed-in... | 2026-10-19 |
| CVE-2026-109434 | medium | 4.3 | No | Fenrir Sleipnir Browser for Android before 3.9.0 contains a UI spoofing vulnerability that allows remote attackers to impersonate the browse... | 2026-10-19 |
| CVE-2026-112363 | medium | 5.3 | No | Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated... | 2026-10-19 |
| CVE-2026-112303 | medium | 4.3 | No | GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gd_resource cookie by suppl... | 2026-10-19 |
| CVE-2026-111045 | high | 7.5 | No | CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypass... | 2026-10-19 |
| CVE-2026-109432 | critical | 9.8 | No | Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate()... | 2026-10-19 |
| CVE-2026-112328 | medium | 4.3 | No | The Sensei LMS WordPress plugin before 4.26.4 contains a broken access control vulnerability in the add_new_module_term AJAX handler that al... | 2026-10-19 |
| CVE-2026-112296 | critical | 9.8 | No | FlyCms through commit edfdf724 contains a default credentials vulnerability that allows unauthenticated remote attackers to gain super admin... | 2026-10-19 |
| CVE-2026-112295 | medium | 5.4 | No | FlyCms through commit edfdf724 contains a mass assignment vulnerability that allows authenticated users to overwrite protected account colum... | 2026-10-19 |
| CVE-2026-112294 | medium | 4.3 | No | FlyCms through commit edfdf724 contains a missing authorization vulnerability in ActionService.counter() that allows authenticated users to... | 2026-10-19 |
| CVE-2026-112292 | critical | 9.8 | No | CheckCle through 1.6.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read, modify and delete recor... | 2026-10-19 |
| CVE-2026-112291 | medium | 5.3 | No | Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 lacks authentication and admin checks on the TaskResource index endpoint, allowing... | 2026-10-19 |
| CVE-2026-112289 | medium | 5.4 | No | Koalixcrm through 1.14.0 contains a stored cross-site scripting vulnerability that allows staff users to inject script by storing malicious... | 2026-10-19 |
| CVE-2026-112287 | high | 7.1 | No | Krayin CRM before 2.2.7 contains a broken object level authorization vulnerability in EmailController write actions that allows scope-restri... | 2026-10-19 |
| CVE-2026-112286 | medium | 6.5 | No | Krayin CRM before 2.2.7 contains an insecure direct object reference vulnerability that allows scope-restricted authenticated users to read... | 2026-10-19 |
| CVE-2026-112285 | medium | 4.3 | No | Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usag... | 2026-10-19 |
| CVE-2026-112284 | low | 3.3 | No | libaribcaption 1.1.0 through 1.1.2 contains a global out-of-bounds read in DecoderImpl::HandleGLGR() that reads past the 78-entry kLatinSpec... | 2026-10-19 |
| CVE-2026-112281 | medium | 6.1 | No | libaribb24 (aribb24) through 1.0.3 contains a stack-based buffer overflow vulnerability in decoder_handle_csi() in src/decoder.c that allows... | 2026-10-19 |
| CVE-2026-112280 | medium | 6.1 | No | libaribb24 (aribb24) through 1.0.3 contains a heap-based buffer overflow vulnerability in src/parser.c that allows attackers to corrupt heap... | 2026-10-19 |