Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110232 | low | 3.3 | No | Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write files outside the extra... | 2026-10-17 |
| CVE-2026-110112 | high | 8.1 | No | Dockhand before 1.0.50 contains a privilege escalation vulnerability that allows users from another tenant to gain admin access because OIDC... | 2026-10-17 |
| CVE-2026-106623 | high | 7.5 | No | ColdFusion is affected by an Incorrect Authorization vulnerability that could lead to disclosure of sensitive memory. An attacker could leve... | 2026-10-17 |
| CVE-2026-103294 | medium | 5.9 | No | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a... | 2026-10-17 |
| CVE-2026-102599 | high | 7.5 | No | Socket.IO enables bidirectional and low-latency communication for every platform. From Engine.IO 6.6.0 until 6.6.10, a transport upgrade can... | 2026-10-17 |
| CVE-2026-100123 | high | 7.5 | No | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a... | 2026-10-17 |
| CVE-2026-100118 | high | 7.5 | No | CAI Content Credentials is affected by an Improper Certificate Validation vulnerability that could result in a Security feature bypass. An a... | 2026-10-17 |
| CVE-2026-100113 | high | 7.5 | No | CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke... | 2026-10-17 |
| CVE-2026-88833 | medium | 6.5 | No | A flaw was found in BusyBox's udhcpc DHCP client. When processing raw DHCP packets, the client replaces the validated packet length with an... | 2026-10-16 |
| CVE-2026-85990 | high | 8.8 | No | Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management... | 2026-10-16 |
| CVE-2026-55562 | critical | 9.0 | No | Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htd... | 2026-10-16 |
| CVE-2026-54700 | not reported | — | No | ConnectBot SSH Client Library is written in Kotlin with Kaitai Struct and KStateMachine. Prior to 0.3.1, the SSH protocol parser trusts atta... | 2026-10-16 |
| CVE-2026-54086 | medium | 5.3 | No | SLE API for Java is an implementation of CCSDS Space Link Extension Services. Prior to 5.1.7, the ISP1 PDU handling path decodes an attacker... | 2026-10-16 |
| CVE-2026-49264 | medium | 6.1 | No | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in o... | 2026-10-16 |
| CVE-2026-110226 | medium | 5.4 | No | QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees to create room types... | 2026-10-16 |
| CVE-2026-110221 | medium | 5.4 | No | QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings form that echoes featur... | 2026-10-16 |
| CVE-2026-110216 | high | 7.1 | No | youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts b... | 2026-10-16 |
| CVE-2026-110211 | high | 8.1 | No | iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete othe... | 2026-10-16 |
| CVE-2026-110206 | high | 8.8 | No | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitra... | 2026-10-16 |
| CVE-2026-110128 | high | 7.5 | No | fuint through commit 4c4bc8a contains a missing authentication vulnerability that allows unauthenticated attackers to retrieve any member's... | 2026-10-16 |