Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111922 | medium | 6.3 | No | Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port with credentials, ev... | 2026-10-19 |
| CVE-2026-111918 | medium | 5.4 | No | Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that allows authenticated u... | 2026-10-19 |
| CVE-2026-111917 | medium | 6.5 | No | Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep WebSocket access after revoca... | 2026-10-19 |
| CVE-2026-111912 | medium | 6.5 | No | Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in ForumService::saveTopic() that allows authent... | 2026-10-19 |
| CVE-2026-111880 | high | 7.4 | No | FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that fails to validate th... | 2026-10-19 |
| CVE-2026-111853 | high | 8.8 | No | An issue was discovered on Tektronix 3 Series MDO devices before 1.21.1. An OS command injection vulnerability exists in the FILESystem:MOUN... | 2026-10-19 |
| CVE-2026-111823 | critical | 9.8 | No | Mage OSS through 0.9.80 before 76c4f46 can proceed with session creation upon encountering an unknown OAuth provider. | 2026-10-19 |
| CVE-2026-64862 | medium | 6.5 | No | Frappe HR is an open-source human resources management solution (HRMS). Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee dat... | 2026-10-19 |
| CVE-2026-59963 | high | 7.1 | No | Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoin... | 2026-10-19 |
| CVE-2026-111759 | high | 7.5 | No | markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadra... | 2026-10-19 |
| CVE-2026-111755 | not reported | — | No | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leav... | 2026-10-19 |
| CVE-2026-112366 | high | 7.5 | No | Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by suppl... | 2026-10-19 |
| CVE-2026-112308 | high | 7.4 | No | crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch int... | 2026-10-19 |
| CVE-2026-111058 | critical | 9.8 | No | Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployment... | 2026-10-19 |
| CVE-2026-8168 | not reported | — | No | Uncontrolled recursion in the SVG parser and renderer of the Qt SVG module (QtSvg) in Qt Group Qt allows attackers to cause a denial of serv... | 2026-10-19 |
| CVE-2026-112290 | medium | 4.7 | No | Intelligence Community UI Kit @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 contains a DOM-based cross-site scripting v... | 2026-10-19 |
| CVE-2026-112282 | medium | 5.5 | No | VideoLAN libbluray through 1.5.1 contains an out-of-bounds read vulnerability in clpi_access_point() that allows attackers to crash applicat... | 2026-10-19 |
| CVE-2026-112264 | high | 7.8 | No | BentoML through 1.4.39 contains a Dockerfile instruction injection vulnerability that allows attackers to add arbitrary build instructions b... | 2026-10-19 |
| CVE-2026-110008 | medium | 4.2 | No | @fastify/oauth2 is a Fastify wrapper for OAuth2 login flows. In versions 7.2.0 through 8.3.1, the state and code-verifier cookies are set wi... | 2026-10-19 |
| CVE-2026-38671 | medium | 6.1 | No | Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed ve... | 2026-10-19 |