Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111793 | medium | 4.3 | No | Openwave Webtop Media Transcoder does not enforce administrator-defined file type restrictions to restrict the file-types to be converted. T... | 2026-10-19 |
| CVE-2026-110897 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations PowerPack Lite for B... | 2026-10-19 |
| CVE-2026-110886 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injectio... | 2026-10-19 |
| CVE-2026-110382 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply Schedule Appointments... | 2026-10-19 |
| CVE-2026-109894 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL... | 2026-10-19 |
| CVE-2026-108485 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill eStore estore allows Reflec... | 2026-10-19 |
| CVE-2026-109131 | medium | 5.4 | No | The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub... | 2026-10-19 |
| CVE-2025-62717 | critical | 9.1 | No | Emlog is an open source website building system. In version 2.5.23, Emlog Pro is vulnerable to a session verification code error due to a cl... | 2026-10-19 |
| CVE-2025-11625 | critical | 9.8 | No | Improper host authentication vulnerability in wolfSSH version 1.4.20 and earlier clients that allows authentication bypass and leaking of cl... | 2026-10-19 |
| CVE-2025-11624 | critical | 9.8 | No | Potential stack buffer overwrite on the SFTP server side when receiving a malicious packet that has a handle size larger than the system han... | 2026-10-19 |
| CVE-2025-11529 | critical | 9.8 | No | A security flaw has been discovered in ChurchCRM up to 5.18.0. This impacts the function AuthMiddleware of the file src/ChurchCRM/Slim/Middl... | 2026-10-19 |
| CVE-2025-11346 | critical | 9.8 | No | A vulnerability has been found in ILIAS up to 8.23/9.13/10.1. This affects the function unserialize of the component Base64 Decoding Handler... | 2026-10-19 |
| CVE-2025-11345 | critical | 9.8 | No | A flaw has been found in ILIAS up to 8.23/9.13/10.1. Affected by this issue is the function unserialize of the component Test Import. This m... | 2026-10-19 |
| CVE-2025-11344 | critical | 9.8 | No | A vulnerability was detected in ILIAS up to 8.23/9.13/10.1. Affected by this vulnerability is an unknown functionality of the component Cert... | 2026-10-19 |
| CVE-2025-59944 | critical | 9.8 | No | Cursor is a code editor built for programming with AI. Versions 1.6.23 and below contain case-sensitive checks in the way Cursor IDE protect... | 2026-10-19 |
| CVE-2025-49844 | critical | 9.9 | No | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially c... | 2026-10-19 |
| CVE-2025-54592 | critical | 9.8 | No | FreshRSS is a free, self-hostable RSS aggregator. Versions 1.26.3 and below do not properly terminate the session during logout. After a use... | 2026-10-19 |
| CVE-2025-9642 | critical | 9.6 | No | An issue has been discovered in GitLab CE/EE affecting all versions from 14.10 before 18.2.7, 18.3 before 18.3.3, and 18.4 before 18.4.1 tha... | 2026-10-19 |
| CVE-2025-59431 | critical | 9.8 | No | MapServer is a system for developing web-based GIS applications. Prior to 8.4.1, the XML Filter Query directive PropertyName is vulnerably t... | 2026-10-19 |
| CVE-2026-100791 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Th... | 2026-10-19 |