{"@context":{"@vocab":"https://schema.org/"},"@type":"ItemList","@id":"https://api.morvs.ai/api/v1/cve/recent","_source":{"data_provider":"AI Analytics","brand_name":"MORVS","brand_url":"https://morvs.ai/","data_provider_url":"https://api.morvs.ai","license":"https://creativecommons.org/publicdomain/zero/1.0/","primary_source":"https://nvd.nist.gov/developers/vulnerabilities","generated_at":"2026-10-26T16:29:20.165Z"},"count":50,"filters":{"severity":null},"items":[{"cve_id":"CVE-2026-116104","published":"2026-10-26T01:17:15.753","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A security flaw has been discovered in Sony Neural Network Libraries up to 1.39.0. This impacts the function func_set_nnabla_version_decorate of the file python/src/nnabla/utils/converter/utils.py of ","url":"https://api.morvs.ai/cve/CVE-2026-116104"},{"cve_id":"CVE-2026-116103","published":"2026-10-26T01:17:15.553","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was identified in Sony Neural Network Libraries up to 1.39.0. This affects the function load_param_in_txt of the file python/src/nnabla/utils/cli/encode_decode_param.py of the componen","url":"https://api.morvs.ai/cve/CVE-2026-116103"},{"cve_id":"CVE-2026-116102","published":"2026-10-26T01:17:15.377","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument pro","url":"https://api.morvs.ai/cve/CVE-2026-116102"},{"cve_id":"CVE-2026-116101","published":"2026-10-26T01:17:15.203","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. The affected element is an unknown function of the file /deletetransac.php. The manipulation of the argument ID results in sq","url":"https://api.morvs.ai/cve/CVE-2026-116101"},{"cve_id":"CVE-2026-116100","published":"2026-10-26T01:17:15.023","status":"Received","cvss_score":2.4,"severity":"LOW","description":"A vulnerability has been found in gougucms up to 4.08.18. Impacted is the function Add of the file app/admin/controller/Level.php of the component User Level Handler. The manipulation of the argument ","url":"https://api.morvs.ai/cve/CVE-2026-116100"},{"cve_id":"CVE-2026-116099","published":"2026-10-26T00:17:14.613","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A flaw has been found in Fusion Creators Studio SCP Containment Breach Multiplayer up to 1.295. This issue affects the function BlitzBanks of the component Skynet++ Virtual Machine. Executing a manipu","url":"https://api.morvs.ai/cve/CVE-2026-116099"},{"cve_id":"CVE-2026-116098","published":"2026-10-26T00:17:14.430","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was detected in SteelRaven7 Ravenfield 25407073. This vulnerability affects the function cacheCoverPoints of the component RFL Custom Map Handler/RFLD Custom Map Handler. Performing a ","url":"https://api.morvs.ai/cve/CVE-2026-116098"},{"cve_id":"CVE-2026-116097","published":"2026-10-26T00:17:14.260","status":"Received","cvss_score":4.3,"severity":"MEDIUM","description":"A security vulnerability has been detected in CloudClassroom-PHP-Project. This affects an unknown part of the file addnewstudent.php. Such manipulation of the argument fname leads to cross site script","url":"https://api.morvs.ai/cve/CVE-2026-116097"},{"cve_id":"CVE-2026-116096","published":"2026-10-25T23:17:41.897","status":"Received","cvss_score":5.3,"severity":"MEDIUM","description":"A weakness has been identified in ggml-org llama.cpp. Affected by this issue is the function list_pockettts_state_slots of the file tools/mtmd/models/pockettts-gen.cpp of the component Pocket-TTS. Thi","url":"https://api.morvs.ai/cve/CVE-2026-116096"},{"cve_id":"CVE-2026-116095","published":"2026-10-25T23:17:41.220","status":"Received","cvss_score":5.3,"severity":"MEDIUM","description":"A vulnerability was identified in smg-project smg 1.7.0/1.8.0/1.9.0/1.10.0/1.10.1. Affected is the function jpeg_turbo::decode_jpeg_rgb of the file crates/multimodal/src/jpeg_turbo.rs of the component","url":"https://api.morvs.ai/cve/CVE-2026-116095"},{"cve_id":"CVE-2026-116094","published":"2026-10-25T22:16:29.253","status":"Received","cvss_score":7.3,"severity":"HIGH","description":"A vulnerability was determined in EyouCMS up to 1.8.3. This impacts the function remote_file_to_local of the file application/function.php. Executing a manipulation can lead to server-side request for","url":"https://api.morvs.ai/cve/CVE-2026-116094"},{"cve_id":"CVE-2026-115635","published":"2026-10-25T20:16:32.293","status":"Received","cvss_score":null,"severity":null,"description":"Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to read another tenant's record through a skipped upsert.\n\nWhen Ash.bulk_create/4 or a single create runs as an upsert w","url":"https://api.morvs.ai/cve/CVE-2026-115635"},{"cve_id":"CVE-2026-115627","published":"2026-10-25T20:16:32.110","status":"Received","cvss_score":null,"severity":null,"description":"Incorrect Authorization vulnerability in ash-project ash_postgres allows a user to load destination records linked to a source record only through another tenant's join rows.\n\nWhen a many_to_many rela","url":"https://api.morvs.ai/cve/CVE-2026-115627"},{"cve_id":"CVE-2026-114214","published":"2026-10-25T20:16:31.920","status":"Received","cvss_score":null,"severity":null,"description":"Incorrect Authorization vulnerability in ash-project ash allows a client to read destination records unrelated to the source record through a through relationship.\n\nWhen a has_many relationship declar","url":"https://api.morvs.ai/cve/CVE-2026-114214"},{"cve_id":"CVE-2026-116063","published":"2026-10-25T18:16:47.110","status":"Received","cvss_score":4.7,"severity":"MEDIUM","description":"A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote ","url":"https://api.morvs.ai/cve/CVE-2026-116063"},{"cve_id":"CVE-2026-116062","published":"2026-10-25T18:16:46.950","status":"Received","cvss_score":7.3,"severity":"HIGH","description":"A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/save_profile.php. The manipulation of the ar","url":"https://api.morvs.ai/cve/CVE-2026-116062"},{"cve_id":"CVE-2026-116061","published":"2026-10-25T18:16:46.790","status":"Received","cvss_score":7.3,"severity":"HIGH","description":"A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This vulnerability affects unknown code of the file /opils/staff/edit_dealer.php. The manipulation of the argument Co","url":"https://api.morvs.ai/cve/CVE-2026-116061"},{"cve_id":"CVE-2026-116060","published":"2026-10-25T17:17:02.123","status":"Received","cvss_score":7.3,"severity":"HIGH","description":"A vulnerability was determined in SourceCodester Performance Indicator System 1.0. This affects an unknown part of the file /opils/staff/adddealer.php. Executing a manipulation of the argument Contact","url":"https://api.morvs.ai/cve/CVE-2026-116060"},{"cve_id":"CVE-2026-115825","published":"2026-10-25T17:17:01.990","status":"Received","cvss_score":null,"severity":null,"description":"HTTP::Server::PSGI versions before 1.0056 for Perl allow a single request to crash the server by declaring a large Content-Length.\n\nThe request body is read with sysread() calls sized by the remaining","url":"https://api.morvs.ai/cve/CVE-2026-115825"},{"cve_id":"CVE-2026-115824","published":"2026-10-25T17:17:01.853","status":"Received","cvss_score":null,"severity":null,"description":"Starman versions before 0.4019 for Perl allow memory exhaustion via unbounded buffering of chunked request bodies.\n\nThe chunked body decoder keeps each chunk in memory until the whole chunk and its CR","url":"https://api.morvs.ai/cve/CVE-2026-115824"},{"cve_id":"CVE-2026-115823","published":"2026-10-25T17:17:01.743","status":"Received","cvss_score":null,"severity":null,"description":"Starman versions before 0.4019 for Perl send response bodies for HEAD requests, desynchronizing responses on keep-alive connections.\n\nFor a HEAD request Starman omits chunked framing but still writes ","url":"https://api.morvs.ai/cve/CVE-2026-115823"},{"cve_id":"CVE-2026-115822","published":"2026-10-25T17:17:01.637","status":"Received","cvss_score":null,"severity":null,"description":"Starman versions before 0.4019 for Perl allow CPU exhaustion via quadratic regex backtracking when parsing chunked request bodies.\n\nStarman decodes chunked request bodies before calling the applicatio","url":"https://api.morvs.ai/cve/CVE-2026-115822"},{"cve_id":"CVE-2026-115817","published":"2026-10-25T17:17:00.940","status":"Received","cvss_score":null,"severity":null,"description":"Starman versions before 0.4019 for Perl allow a stalled request body to hold a worker indefinitely, as read_timeout covers only the headers.\n\nContent-Length and chunked request bodies are read with bl","url":"https://api.morvs.ai/cve/CVE-2026-115817"},{"cve_id":"CVE-2026-116058","published":"2026-10-25T16:16:50.350","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was found in Alfresco Activiti up to 7.21.0-rc.692. Affected by this issue is the function JuelScriptEngine.eval of the file JuelScriptEngine.java. Performing a manipulation results in","url":"https://api.morvs.ai/cve/CVE-2026-116058"},{"cve_id":"CVE-2026-116057","published":"2026-10-25T16:16:50.167","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability has been found in KodCloud KodExplorer up to 4.55. Affected by this vulnerability is an unknown functionality of the file app/controller/editor.class.php of the component Online Editor","url":"https://api.morvs.ai/cve/CVE-2026-116057"},{"cve_id":"CVE-2026-116056","published":"2026-10-25T16:16:49.070","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A flaw has been found in KodCloud KodExplorer up to 4.56. Affected is the function request_url_safe of the file app/function/web.function.php of the component Remote Download. This manipulation causes","url":"https://api.morvs.ai/cve/CVE-2026-116056"},{"cve_id":"CVE-2026-116055","published":"2026-10-25T15:17:02.430","status":"Received","cvss_score":6.3,"severity":"MEDIUM","description":"A vulnerability was detected in SourceCodester Performance Indicator System 1.0. This impacts an unknown function of the file /opils/admin/deleteproduct.php. The manipulation of the argument ID result","url":"https://api.morvs.ai/cve/CVE-2026-116055"},{"cve_id":"CVE-2026-116054","published":"2026-10-25T15:17:01.307","status":"Received","cvss_score":2.2,"severity":"LOW","description":"A security vulnerability has been detected in SH3. This affects an unknown function of the component Módulo de Gestão/Módulo de Arrecadação. The manipulation leads to password hash with insufficient c","url":"https://api.morvs.ai/cve/CVE-2026-116054"},{"cve_id":"CVE-2026-116211","published":"2026-10-25T14:17:02.187","status":"Deferred","cvss_score":8.2,"severity":"HIGH","description":"YesWiki 4.5.0 before 4.7.0 contains an SQL injection vulnerability in PageManager::save(), where the date_maj_fiche field of a Bazar entry-creation request is concatenated unescaped into an INSERT sta","url":"https://api.morvs.ai/cve/CVE-2026-116211"},{"cve_id":"CVE-2026-116208","published":"2026-10-25T14:17:02.010","status":"Deferred","cvss_score":8.1,"severity":"HIGH","description":"YesWiki from 4.6.2 before 4.7.0 contains a missing authorization vulnerability in ActivityPubService::syncActorPosts that lets malicious ActivityPub servers manipulate other actors' mirrored entries. ","url":"https://api.morvs.ai/cve/CVE-2026-116208"},{"cve_id":"CVE-2026-116207","published":"2026-10-25T14:17:01.847","status":"Deferred","cvss_score":9.1,"severity":"CRITICAL","description":"YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability in SearchManager::prepareSearchRequest(). Field names from the query and searchf","url":"https://api.morvs.ai/cve/CVE-2026-116207"},{"cve_id":"CVE-2026-116206","published":"2026-10-25T14:17:01.690","status":"Deferred","cvss_score":6.4,"severity":"MEDIUM","description":"YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into comment bodies using the wakka raw-HTML syntax. Attackers can","url":"https://api.morvs.ai/cve/CVE-2026-116206"},{"cve_id":"CVE-2026-116205","published":"2026-10-25T14:17:01.513","status":"Deferred","cvss_score":5.3,"severity":"MEDIUM","description":"YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying [[|URL]] wiki syntax to the render handler.","url":"https://api.morvs.ai/cve/CVE-2026-116205"},{"cve_id":"CVE-2026-116204","published":"2026-10-25T14:17:01.350","status":"Deferred","cvss_score":8.1,"severity":"HIGH","description":"YesWiki before 4.7.0 contains a cross-site request forgery vulnerability in the despam action (tools/security/actions/despam.php) that lets unauthenticated attackers delete or restore pages through an","url":"https://api.morvs.ai/cve/CVE-2026-116204"},{"cve_id":"CVE-2026-116203","published":"2026-10-25T14:17:01.187","status":"Deferred","cvss_score":6.1,"severity":"MEDIUM","description":"YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes attacker-controlled token values without output encoding. Anonymous attackers can injec","url":"https://api.morvs.ai/cve/CVE-2026-116203"},{"cve_id":"CVE-2026-116202","published":"2026-10-25T14:17:01.020","status":"Deferred","cvss_score":5.4,"severity":"MEDIUM","description":"YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitized SVG files through the bazar ImageField class. Attackers ca","url":"https://api.morvs.ai/cve/CVE-2026-116202"},{"cve_id":"CVE-2026-116201","published":"2026-10-25T14:17:00.877","status":"Received","cvss_score":8.8,"severity":"HIGH","description":"Snipe-IT before 8.5.0 contains a SAML assertion replay vulnerability that allows attackers to reuse captured assertions by exploiting a non-atomic nonce check in the SAML acs handler. Attackers can se","url":"https://api.morvs.ai/cve/CVE-2026-116201"},{"cve_id":"CVE-2026-116200","published":"2026-10-25T14:17:00.740","status":"Received","cvss_score":5.9,"severity":"MEDIUM","description":"Snipe-IT before 8.6.3 ignores the ldap_start_tls() return value in Ldap::connectToLdap(), allowing on-path attackers to force cleartext LDAP binds. Attackers can answer the StartTLS request with a pro","url":"https://api.morvs.ai/cve/CVE-2026-116200"},{"cve_id":"CVE-2026-116199","published":"2026-10-25T14:17:00.593","status":"Received","cvss_score":8.1,"severity":"HIGH","description":"Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in the user whose username matches the Google account email without enforcing the acti","url":"https://api.morvs.ai/cve/CVE-2026-116199"},{"cve_id":"CVE-2026-116198","published":"2026-10-25T14:17:00.453","status":"Received","cvss_score":4.3,"severity":"MEDIUM","description":"Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\\AssetsController::store that writes plaintext into encrypted-flagged custom-field columns when callers lack assets.view.encrypt","url":"https://api.morvs.ai/cve/CVE-2026-116198"},{"cve_id":"CVE-2026-116197","published":"2026-10-25T14:17:00.283","status":"Deferred","cvss_score":2.6,"severity":"LOW","description":"Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. Whe","url":"https://api.morvs.ai/cve/CVE-2026-116197"},{"cve_id":"CVE-2026-116196","published":"2026-10-25T14:17:00.133","status":"Received","cvss_score":5.3,"severity":"MEDIUM","description":"Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account Authorization token and SSE-C keys on HTTP redirects from --b2-download-url hosts. Atta","url":"https://api.morvs.ai/cve/CVE-2026-116196"},{"cve_id":"CVE-2026-116195","published":"2026-10-25T14:16:59.990","status":"Received","cvss_score":6.1,"severity":"MEDIUM","description":"Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims the .rclonelink suffix from a path after the containment check, so a name can re","url":"https://api.morvs.ai/cve/CVE-2026-116195"},{"cve_id":"CVE-2026-116194","published":"2026-10-25T14:16:59.847","status":"Received","cvss_score":6.8,"severity":"MEDIUM","description":"Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which disables the state check and trusts the hostname parameter.","url":"https://api.morvs.ai/cve/CVE-2026-116194"},{"cve_id":"CVE-2026-116193","published":"2026-10-25T14:16:59.703","status":"Received","cvss_score":5.3,"severity":"MEDIUM","description":"Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets unauthenticated attackers skip authentication by sending OPTIONS requests. Attackers can prob","url":"https://api.morvs.ai/cve/CVE-2026-116193"},{"cve_id":"CVE-2026-116192","published":"2026-10-25T14:16:59.550","status":"Received","cvss_score":5.9,"severity":"MEDIUM","description":"rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated attackers to redirect http and netstorage backend requests by supplying a double-slash r","url":"https://api.morvs.ai/cve/CVE-2026-116192"},{"cve_id":"CVE-2026-116191","published":"2026-10-25T14:16:59.400","status":"Received","cvss_score":7.5,"severity":"HIGH","description":"Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to write above the served root by sending an unvalidated '..' path component. Attacke","url":"https://api.morvs.ai/cve/CVE-2026-116191"},{"cve_id":"CVE-2026-116190","published":"2026-10-25T14:16:59.260","status":"Received","cvss_score":3.7,"severity":"LOW","description":"rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured custom credential headers to different hosts on HTTP 3xx red","url":"https://api.morvs.ai/cve/CVE-2026-116190"},{"cve_id":"CVE-2026-116189","published":"2026-10-25T14:16:59.120","status":"Received","cvss_score":7.5,"severity":"HIGH","description":"rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums from unsigned bytes preceding the PGP-clearsigned SHA256SUMS block. Attackers contr","url":"https://api.morvs.ai/cve/CVE-2026-116189"},{"cve_id":"CVE-2026-116188","published":"2026-10-25T14:16:58.973","status":"Received","cvss_score":5.3,"severity":"MEDIUM","description":"rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory accounting that bypasses the configured buffer limit. Attackers can open two concurr","url":"https://api.morvs.ai/cve/CVE-2026-116188"}]}