Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111895 | medium | 6.8 | No | phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links... | 2026-10-19 |
| CVE-2026-111890 | medium | 5.5 | No | phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in UserController::updateUserRights that drops p... | 2026-10-19 |
| CVE-2026-111720 | medium | 5.3 | No | fish-island-backend through commit 7c61b78 contains an unauthenticated server-side request forgery vulnerability that allows remote attacker... | 2026-10-19 |
| CVE-2026-110902 | medium | 4.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incor... | 2026-10-19 |
| CVE-2026-111410 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XS... | 2026-10-19 |
| CVE-2026-108374 | high | 7.7 | No | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modificatio... | 2026-10-19 |
| CVE-2026-111715 | medium | 4.3 | No | Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated employees read other depar... | 2026-10-19 |
| CVE-2026-111710 | high | 7.5 | No | Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's user_auth() function that allow... | 2026-10-19 |
| CVE-2026-107194 | not reported | — | No | Sungrow iSolarCloud before 2026-08-25 allows authentication bypass and account takeover via "login_type":"5" in a login request, potentially... | 2026-10-19 |
| CVE-2026-102607 | high | 8.8 | No | ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents() function concatenates... | 2026-10-19 |
| CVE-2026-101952 | high | 7.5 | No | An Improper Validation of Consistency within Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos... | 2026-10-19 |
| CVE-2026-102066 | medium | 6.5 | No | A Improper Validation of Specified Quantity in Input vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Jun... | 2026-10-19 |
| CVE-2026-112140 | medium | 6.3 | No | A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_mo... | 2026-10-19 |
| CVE-2026-112107 | medium | 6.3 | No | A flaw has been found in ztxz16 fastllm up to 1.8.2. Affected by this issue is the function SafeTensorItem::CreateBuffer of the file src/mod... | 2026-10-19 |
| CVE-2026-112103 | low | 3.7 | No | A vulnerability has been found in f3-factory fatfree-core up to 3.9.2. This vulnerability affects the function _curl of the file web.php of... | 2026-10-19 |
| CVE-2026-111407 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored... | 2026-10-19 |
| CVE-2026-110379 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows R... | 2026-10-19 |
| CVE-2026-110895 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-l... | 2026-10-19 |
| CVE-2026-110383 | high | 7.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent Forms signature-flue... | 2026-10-19 |
| CVE-2026-109895 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM... | 2026-10-19 |