Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111637 | medium | 5.3 | No | NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read accounting transaction r... | 2026-10-16 |
| CVE-2026-111632 | medium | 5.4 | No | Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create or move records into d... | 2026-10-16 |
| CVE-2026-111627 | high | 7.2 | No | HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to perform write actions whil... | 2026-10-16 |
| CVE-2026-111622 | medium | 6.8 | No | smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated attackers to steal OAuth2... | 2026-10-16 |
| CVE-2026-111617 | medium | 6.5 | No | WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to connect to the /ws/ui/web/... | 2026-10-16 |
| CVE-2026-111612 | high | 7.5 | No | netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve donat... | 2026-10-16 |
| CVE-2026-111607 | high | 7.1 | No | Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant users to overwrite anothe... | 2026-10-16 |
| CVE-2026-111392 | medium | 4.8 | No | SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote attackers to poison cached... | 2026-10-16 |
| CVE-2026-111322 | critical | 9.8 | No | Archon 0.2.13 through 0.11.1 contains a missing authentication vulnerability that allows unauthenticated attackers to access the /api/* cont... | 2026-10-16 |
| CVE-2026-111284 | medium | 5.4 | No | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject... | 2026-10-16 |
| CVE-2026-109839 | low | 3.1 | No | IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing initialization vector in... | 2026-10-16 |
| CVE-2026-109838 | medium | 5.1 | No | IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of cryptographic signature. | 2026-10-16 |
| CVE-2026-111279 | high | 7.5 | No | Dragonfly through 2.0.2 contains an unbounded memory allocation vulnerability that allows unauthenticated clients to exhaust memory by passi... | 2026-10-16 |
| CVE-2026-111273 | medium | 6.1 | No | unarr through 1.1.1 contains an off-by-one heap-based buffer overflow in tar_get_name() in tar/parse-tar.c, reachable through the ar_entry_g... | 2026-10-16 |
| CVE-2026-111252 | medium | 6.5 | No | A denial of service vulnerability exists in the XML parsing of multiple versions of OpenNMS Meridian and Horizon. OpenNMS parsed XML without... | 2026-10-16 |
| CVE-2026-111235 | critical | 9.1 | No | An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Secur... | 2026-10-16 |
| CVE-2026-105040 | high | 8.8 | No | The EnergizeLab Eilik NestJS auth service accepts a user-controlled user ID in account update requests (mass assignment). A registered user... | 2026-10-16 |
| CVE-2026-105039 | critical | 9.6 | No | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated... | 2026-10-16 |
| CVE-2026-105038 | critical | 9.8 | No | The EnergizeLab Eilik and EilikO FastAPI AI inference and profiling services expose AI model administration functions without authentication... | 2026-10-16 |
| CVE-2026-105037 | critical | 9.9 | No | EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 allow any registered, low-privilege account to read arbitrary file... | 2026-10-16 |