Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-112269 | medium | 6.5 | No | SGLang through 0.5.22 with the Mooncake disaggregation backend accepts unauthenticated decode registration messages on the Prefill rank ZMQ... | 2026-10-19 |
| CVE-2026-112190 | medium | 5.3 | No | A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer... | 2026-10-19 |
| CVE-2026-112199 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-wo... | 2026-10-19 |
| CVE-2026-112142 | high | 7.3 | No | A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vuln... | 2026-10-19 |
| CVE-2026-112138 | medium | 4.7 | No | A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dm... | 2026-10-19 |
| CVE-2026-112105 | low | 3.7 | No | A vulnerability has been found in GlitterWare Passy up to 1.10.1. The affected element is the function MyHttpOverrides in the library lib/ma... | 2026-10-19 |
| CVE-2026-112179 | not reported | — | No | In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote push. The filtering of non... | 2026-10-19 |
| CVE-2026-112047 | medium | 5.4 | No | OneUptime 14.0.2 before 14.0.69 contains an incorrect authorization vulnerability that allows authenticated project members to act on cluste... | 2026-10-19 |
| CVE-2026-112018 | high | 7.0 | No | cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outsid... | 2026-10-19 |
| CVE-2026-112003 | medium | 5.9 | No | ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with import_orphans permis... | 2026-10-19 |
| CVE-2026-111985 | medium | 4.3 | No | A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.1. This impacts the function read_metadata_from_safetensors of... | 2026-10-19 |
| CVE-2026-111829 | medium | 6.5 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Mailster WP Mail... | 2026-10-19 |
| CVE-2026-111828 | medium | 4.3 | No | Improper Validation of Specified Quantity in Input vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Fu... | 2026-10-19 |
| CVE-2026-111839 | medium | 5.3 | No | Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incor... | 2026-10-19 |
| CVE-2026-111836 | medium | 4.3 | No | Missing Authorization vulnerability in WP ManageNinja LLC FluentCommunity fluent-community allows Exploiting Incorrectly Configured Access C... | 2026-10-19 |
| CVE-2026-111450 | medium | 5.9 | No | Wheels through 4.1.1 derives its default production error-email address from the Host header of the request that starts the application. If... | 2026-10-19 |
| CVE-2026-111445 | high | 8.1 | No | Wheels 4.0.0 through 4.1.2 before 4.2.0 replaces incoming scope conditions with a primary-key condition in findByKey() and exists(key=). For... | 2026-10-19 |
| CVE-2026-111061 | medium | 4.3 | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a... | 2026-10-19 |
| CVE-2026-111414 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor j... | 2026-10-19 |
| CVE-2026-110883 | medium | 6.5 | No | Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat allows Aut... | 2026-10-19 |