Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111685 | high | 7.5 | No | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL by supplying a craft... | 2026-10-19 |
| CVE-2026-111680 | high | 8.3 | No | APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to access other teams' ser... | 2026-10-19 |
| CVE-2026-111675 | high | 7.4 | No | Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that allows unauthenticated att... | 2026-10-19 |
| CVE-2026-111670 | medium | 4.3 | No | ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows authenticated low-privi... | 2026-10-19 |
| CVE-2026-111665 | medium | 5.4 | No | Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController that allows any authent... | 2026-10-19 |
| CVE-2026-111660 | medium | 6.5 | No | waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to cancel any member's pen... | 2026-10-19 |
| CVE-2026-111655 | low | 3.8 | No | ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows non-super administrators... | 2026-10-19 |
| CVE-2026-111650 | high | 8.6 | No | ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that allows unauthenticated att... | 2026-10-19 |
| CVE-2026-111645 | medium | 5.4 | No | MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows authenticated users to... | 2026-10-19 |
| CVE-2026-111640 | medium | 5.4 | No | DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the membership check for... | 2026-10-19 |
| CVE-2026-111635 | medium | 4.3 | No | Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files outside the solution d... | 2026-10-19 |
| CVE-2026-111630 | medium | 5.4 | No | abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the LINGYUN.Abp.AIManagement module that... | 2026-10-19 |
| CVE-2026-111625 | medium | 5.0 | No | 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows Contributor-level multisite users to... | 2026-10-19 |
| CVE-2026-84018 | high | 7.0 | No | Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-84019 | high | 7.0 | No | Use after free in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-84020 | high | 7.0 | No | Use after free in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-69880 | high | 7.8 | No | Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges... | 2026-10-19 |
| CVE-2026-69882 | high | 7.8 | No | Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-69883 | critical | 9.8 | No | Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-69991 | high | 7.5 | No | Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. | 2026-10-19 |