Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111701 | high | 7.0 | No | OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to access private bucke... | 2026-10-16 |
| CVE-2026-111696 | medium | 6.5 | No | data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in AesPasswordEncAndDecServiceImpl, allowing auth... | 2026-10-16 |
| CVE-2026-111691 | high | 7.4 | No | WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any tenant and privilege... | 2026-10-16 |
| CVE-2026-111686 | high | 7.5 | No | IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL through the num path... | 2026-10-16 |
| CVE-2026-111681 | high | 8.8 | No | EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to manage accounts because t... | 2026-10-16 |
| CVE-2026-111676 | medium | 4.3 | No | Faveo Helpdesk through 2.0.3 contains a broken access control vulnerability that allows authenticated agents to read tickets in other depart... | 2026-10-16 |
| CVE-2026-111671 | high | 7.1 | No | Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated users to stop, reset, cl... | 2026-10-16 |
| CVE-2026-111666 | medium | 4.3 | No | Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users to read other tenants... | 2026-10-16 |
| CVE-2026-111661 | medium | 5.3 | No | waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to send arbitrary email by... | 2026-10-16 |
| CVE-2026-111656 | medium | 5.4 | No | ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to access another tenant's... | 2026-10-16 |
| CVE-2026-111651 | medium | 6.5 | No | Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module DownloadController that allo... | 2026-10-16 |
| CVE-2026-111646 | medium | 5.9 | No | SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to download any stored file by... | 2026-10-16 |
| CVE-2026-111641 | critical | 9.8 | No | FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain sessions for any us... | 2026-10-16 |
| CVE-2026-111636 | high | 8.1 | No | OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator... | 2026-10-16 |
| CVE-2026-111631 | medium | 5.4 | No | Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke external connection AJ... | 2026-10-16 |
| CVE-2026-111626 | critical | 9.8 | No | Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/*... | 2026-10-16 |
| CVE-2026-111621 | medium | 4.3 | No | TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read other owners' raw fo... | 2026-10-16 |
| CVE-2026-111616 | medium | 4.9 | No | Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site administrator to read... | 2026-10-16 |
| CVE-2026-111611 | medium | 5.4 | No | roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows authenticated users to cancel... | 2026-10-16 |
| CVE-2026-111606 | high | 8.1 | No | Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to merge arbitrary persons b... | 2026-10-16 |