Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110123 | high | 7.1 | No | Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS co... | 2026-10-16 |
| CVE-2026-110118 | medium | 6.5 | No | WorkFlow-Engine through 9.6.11 contains a missing authorization vulnerability that allows authenticated users to complete or reassign other... | 2026-10-16 |
| CVE-2026-110113 | medium | 4.3 | No | PublicCMS through V6.202608.a contains an insecure direct object reference vulnerability in the TradeAddressController tradeAddress/save han... | 2026-10-16 |
| CVE-2026-110106 | medium | 4.2 | No | RuoYi-Vue-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other user... | 2026-10-16 |
| CVE-2026-109429 | high | 8.8 | No | Mistral Vibe before 2.25.4 contains a command permission gate bypass vulnerability that allows attackers to execute arbitrary commands by hi... | 2026-10-16 |
| CVE-2026-108381 | high | 8.8 | No | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avr... | 2026-10-16 |
| CVE-2026-108376 | high | 8.8 | No | dataclasses-avroschema generates Avro schemas from Python dataclasses, Pydantic models, and Faust Records and generates Python code from Avr... | 2026-10-16 |
| CVE-2026-110101 | medium | 5.4 | No | Koillection through 1.8.4 contains a stored cross-site scripting vulnerability that allows authenticated users to upload HTML files as Datum... | 2026-10-16 |
| CVE-2026-109607 | high | 7.3 | No | A flaw has been found in SourceCodester Online Exam System 1.0. Affected is an unknown function of the file adminpanel/admin/query/loginExe.... | 2026-10-16 |
| CVE-2026-104126 | medium | 6.0 | No | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17-lts, JumpServer's Ansible... | 2026-10-16 |
| CVE-2026-102981 | medium | 6.5 | No | Plane is an open-source project management tool. Prior to 1.4.0, self-hosted Plane deployments allow unauthenticated GET requests to api/wor... | 2026-10-16 |
| CVE-2026-100133 | critical | 9.3 | No | Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scri... | 2026-10-16 |
| CVE-2026-111593 | not reported | — | No | Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin and was... | 2026-10-16 |
| CVE-2026-103910 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-101335. Reason: This candidate is a reservation duplica... | 2026-10-16 |
| CVE-2026-107913 | not reported | — | No | Rejected reason: This CVE ID is a duplicate of CVE-2026-39749 and was never published. Both IDs were assigned to the same Broken Access Cont... | 2026-10-16 |
| CVE-2026-105151 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-105142 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-104922 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-16 |
| CVE-2026-104011 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-94257. Reason: This candidate is a reservation duplicat... | 2026-10-16 |
| CVE-2026-88836 | not reported | — | No | Rejected reason: Red Hat Product Security determined this is not a security vulnerability. BusyBox internal TLS is intentionally minimal and... | 2026-10-16 |