Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2023-54410 | medium | 4.3 | No | Frappe before 13.22.0 contains an improper authorization vulnerability that allows authenticated users to rename documents by exploiting a m... | 2026-10-18 |
| CVE-2026-111909 | high | 8.1 | No | phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated non-superadmin users... | 2026-10-18 |
| CVE-2026-111904 | medium | 5.3 | No | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an information disclosure vulnerability that allows unauthenticated attackers to read hidden... | 2026-10-18 |
| CVE-2026-111898 | high | 7.5 | No | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local account... | 2026-10-18 |
| CVE-2026-111893 | medium | 6.5 | No | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in GroupController::saveCategoryRestrictions() that let... | 2026-10-18 |
| CVE-2026-111888 | low | 2.7 | No | phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking the editnews right t... | 2026-10-18 |
| CVE-2026-111389 | high | 7.7 | No | Frappe HRMS 14.x before 14.38.2, 15.x before 15.64.0, and 16.x before 16.18.0 contains a SQL injection vulnerability in some endpoints cause... | 2026-10-18 |
| CVE-2026-110615 | high | 7.1 | No | jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-pr... | 2026-10-18 |
| CVE-2026-109461 | medium | 5.9 | No | Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over... | 2026-10-18 |
| CVE-2026-109640 | high | 8.1 | No | Frappe ERPNext before 16.22.0 contains a missing authorization vulnerability that allows authenticated users to modify records by invoking e... | 2026-10-18 |
| CVE-2026-109399 | high | 8.1 | No | SWUpdate through 2026.05.1 contains an improper certificate validation vulnerability in crypto/swupdate_cms_verify_openssl.c that trusts unt... | 2026-10-18 |
| CVE-2026-109393 | medium | 6.3 | No | QloApps through 1.7.0 contains an insecure direct object reference vulnerability in back-office AJAX handlers of AdminOrdersController, Admi... | 2026-10-18 |
| CVE-2026-109316 | medium | 6.5 | No | Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete... | 2026-10-18 |
| CVE-2026-109311 | medium | 6.5 | No | vLLM before 0.29.0 passes uploaded audio to the PyAV/FFmpeg av.open() fallback with only a file-size check, exposing FFmpeg's IAMF parser he... | 2026-10-18 |
| CVE-2026-109306 | medium | 5.9 | No | Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that le... | 2026-10-18 |
| CVE-2026-109301 | medium | 5.9 | No | Parse Server before 8.6.95 and 9.0.0 before 9.10.2-alpha.3 does not resolve file references lacking a URL before passing objects to Cloud Co... | 2026-10-18 |
| CVE-2026-109291 | high | 7.3 | No | Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in vict... | 2026-10-18 |
| CVE-2026-109286 | high | 8.1 | No | Open WebUI from 0.7.0 before 0.11.4 contains a cross-origin message handling vulnerability in SyncStatsModal that allows any website to stea... | 2026-10-18 |
| CVE-2026-109227 | high | 7.5 | No | SGLang through 0.5.21 contains an unbounded memory allocation vulnerability in preprocess_video in qwen_vl.py that decodes frames at full so... | 2026-10-18 |
| CVE-2026-109204 | medium | 6.3 | No | LogicalDOC Community Edition through 9.3 contains an improper authorization vulnerability in the PswRecovery servlet that fails to bind pass... | 2026-10-18 |