{"@context":{"@vocab":"https://schema.org/","dcterms":"http://purl.org/dc/terms/","prov":"http://www.w3.org/ns/prov#"},"@type":"ItemList","@id":"https://api.morvs.ai/api/v1/nvd/recent","_source":{"data_provider":"AI Analytics","brand_name":"MORVS","brand_url":"https://morvs.ai/","data_provider_url":"https://api.morvs.ai","license":"https://creativecommons.org/publicdomain/zero/1.0/","dcterms:license":"https://creativecommons.org/publicdomain/zero/1.0/","generated_at":"2026-10-26T16:29:26.648Z","primary_source":"https://nvd.nist.gov/"},"filter":{"severity":null,"min_score":null,"q":null},"count":50,"items":[{"cve_id":"CVE-2026-116052","published":"2026-10-25T13:16:27.407","last_modified":"2026-10-25T13:16:28.060","vuln_status":"Deferred","cvss_base_score":4.3,"cvss_severity":"MEDIUM","description_excerpt":"A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.8. The affected element is an unknown function. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. The vendor was contacted early about this disclo","cwes_json":"[\"CWE-352\",\"CWE-862\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116052"},{"cve_id":"CVE-2026-116137","published":"2026-10-25T12:16:30.250","last_modified":"2026-10-25T12:16:30.373","vuln_status":"Deferred","cvss_base_score":3.7,"cvss_severity":"LOW","description_excerpt":"adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonically equivalent entry names like './hello.txt' and 'hello.txt'. Attackers can craft ZIP archives where getEntry() or readAsText() validates be","cwes_json":"[\"CWE-436\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116137"},{"cve_id":"CVE-2026-116136","published":"2026-10-25T12:16:30.080","last_modified":"2026-10-25T12:16:30.200","vuln_status":"Deferred","cvss_base_score":5.9,"cvss_severity":"MEDIUM","description_excerpt":"ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows staff users to share files without authorization by linking file versions. Attackers can link their file onto an intermediate revision or assign out-of-scope cli","cwes_json":"[\"CWE-863\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116136"},{"cve_id":"CVE-2026-116073","published":"2026-10-25T12:16:29.920","last_modified":"2026-10-25T12:16:29.920","vuln_status":"Received","cvss_base_score":6.5,"cvss_severity":"MEDIUM","description_excerpt":"Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers to write files outside the models directory via percent-encoded separators. Attackers can trick a user into running '/download model' with a crafted URL containin","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116073"},{"cve_id":"CVE-2026-116072","published":"2026-10-25T12:16:29.763","last_modified":"2026-10-25T12:16:29.763","vuln_status":"Received","cvss_base_score":5.4,"cvss_severity":"MEDIUM","description_excerpt":"Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to log victims into an attacker-controlled account because the exported LoginChromeCustomTabActivity redirect handler checks a hardcoded OAuth state value. Attackers ","cwes_json":"[\"CWE-352\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116072"},{"cve_id":"CVE-2026-116071","published":"2026-10-25T12:16:29.623","last_modified":"2026-10-25T12:16:29.623","vuln_status":"Received","cvss_base_score":5.9,"cvss_severity":"MEDIUM","description_excerpt":"rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because the premium sync key is a single unsalted SHA-256 of the user password. Attackers who obtain an uploaded backup blob can run GPU-parallel offline password guessin","cwes_json":"[\"CWE-916\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116071"},{"cve_id":"CVE-2026-116070","published":"2026-10-25T12:16:29.480","last_modified":"2026-10-25T12:16:29.480","vuln_status":"Received","cvss_base_score":6.5,"cvss_severity":"MEDIUM","description_excerpt":"Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows unauthenticated attackers to read and overwrite configuration via /api/config. Attackers can retrieve the WeChat webhook URL and Telegram bot token, and overwri","cwes_json":"[\"CWE-306\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116070"},{"cve_id":"CVE-2026-116069","published":"2026-10-25T12:16:29.330","last_modified":"2026-10-25T12:16:29.330","vuln_status":"Received","cvss_base_score":6.5,"cvss_severity":"MEDIUM","description_excerpt":"NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch internal addresses by supplying a crafted domain value to POST /audit-plan. Attackers can submit IP literals, localhost, or private an","cwes_json":"[\"CWE-918\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116069"},{"cve_id":"CVE-2026-116068","published":"2026-10-25T12:16:29.153","last_modified":"2026-10-25T12:16:29.277","vuln_status":"Deferred","cvss_base_score":8.8,"cvss_severity":"HIGH","description_excerpt":"Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization to control other tenants' applications by supplying foreign applicationId values. Attackers can call procedures like saveEnvironment, updateTraefikConfig, deplo","cwes_json":"[\"CWE-639\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116068"},{"cve_id":"CVE-2026-116067","published":"2026-10-25T12:16:28.997","last_modified":"2026-10-25T12:16:28.997","vuln_status":"Received","cvss_base_score":8.2,"cvss_severity":"HIGH","description_excerpt":"Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and DeleteSheetBackups handlers that lets unauthenticated attackers read files and delete backups through ../ sequences in file names. Attackers can send crafted names to the edito","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116067"},{"cve_id":"CVE-2026-116066","published":"2026-10-25T12:16:27.370","last_modified":"2026-10-25T12:16:28.680","vuln_status":"Deferred","cvss_base_score":6.8,"cvss_severity":"MEDIUM","description_excerpt":"Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy that allows attackers to bypass isInternalHost checks via DNS rebinding. Attackers controlling DNS for a scrape target can return a public address during validation","cwes_json":"[\"CWE-918\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116066"},{"cve_id":"CVE-2026-116050","published":"2026-10-25T09:16:27.740","last_modified":"2026-10-25T09:16:27.740","vuln_status":"Received","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. This affects an unknown part of the file /source/registerform3.php of the component Registration. The manipulation of the argument pemail leads to sql injectio","cwes_json":"[\"CWE-74\",\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116050"},{"cve_id":"CVE-2026-116049","published":"2026-10-25T09:16:27.543","last_modified":"2026-10-25T09:16:27.543","vuln_status":"Received","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysql_query of the file /source/registerform2.php of the component Registration Wizard. Executing a manipulation of the argument un","cwes_json":"[\"CWE-74\",\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116049"},{"cve_id":"CVE-2026-116048","published":"2026-10-25T08:16:26.780","last_modified":"2026-10-25T08:16:26.780","vuln_status":"Received","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this vulnerability is the function mysql_query of the file /source/registerform1.php of the component Registration. Performing a manipulation of the ar","cwes_json":"[\"CWE-74\",\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116048"},{"cve_id":"CVE-2026-116047","published":"2026-10-25T08:16:26.583","last_modified":"2026-10-25T08:16:26.583","vuln_status":"Received","cvss_base_score":4.3,"cvss_severity":"MEDIUM","description_excerpt":"A vulnerability has been found in Privoce Vocechat up to 0.9.121. This issue affects some unknown processing of the file widget.html of the component Query Parameter Handler. Such manipulation of the argument welcome leads to cross site scripting. The attack can be launched remot","cwes_json":"[\"CWE-79\",\"CWE-94\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116047"},{"cve_id":"CVE-2026-116046","published":"2026-10-25T07:16:47.180","last_modified":"2026-10-25T07:16:47.180","vuln_status":"Received","cvss_base_score":5.3,"cvss_severity":"MEDIUM","description_excerpt":"A flaw has been found in eventcatalog sdk up to 2.29.0. This vulnerability affects the function getCustomDoc/writeCustomDoc/rmCustomDoc of the file packages/sdk/src/custom-docs.ts of the component Custom Documentation Helpers. This manipulation of the argument options.path causes","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116046"},{"cve_id":"CVE-2026-116045","published":"2026-10-25T07:16:46.983","last_modified":"2026-10-25T07:16:46.983","vuln_status":"Received","cvss_base_score":4.3,"cvss_severity":"MEDIUM","description_excerpt":"A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.0. This affects the function get_reference of the file skills/motion-designer/references/motion-dev-guidelines.md of the component MCP Interface. The manipulation of the argument Name results in path traversal. It i","cwes_json":"[\"CWE-22\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116045"},{"cve_id":"CVE-2026-94295","published":"2026-10-25T06:16:33.037","last_modified":"2026-10-25T06:16:33.037","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment notification actually originated from the payment provider before marking the associated order as paid, allowing unauthenticated attackers to mark arbitrary orders as paid","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-94295"},{"cve_id":"CVE-2026-116044","published":"2026-10-25T06:16:32.500","last_modified":"2026-10-25T06:16:32.500","vuln_status":"Received","cvss_base_score":6.3,"cvss_severity":"MEDIUM","description_excerpt":"A security vulnerability has been detected in prasathmani TinyFileManager up to 2.6. Affected by this issue is some unknown functionality of the file tinyfilemanager.php of the component Remote URL File Upload Module. The manipulation leads to unrestricted upload. It is possible ","cwes_json":"[\"CWE-284\",\"CWE-434\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116044"},{"cve_id":"CVE-2026-115251","published":"2026-10-25T06:16:32.373","last_modified":"2026-10-25T06:16:32.373","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The Duplicator  WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to install Duplicator  WordPress plugin before 5.0.0, and additionally exposes the routine without authentication, allowing an administrator of a multisite child site wh","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115251"},{"cve_id":"CVE-2026-115214","published":"2026-10-25T06:16:32.263","last_modified":"2026-10-25T06:16:32.263","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The Datawiza Proxy Auth Plugin  WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP request headers it trusts originate from a trusted reverse proxy, allowing unauthenticated attackers to create and authenticate as a WordPress administrator.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115214"},{"cve_id":"CVE-2026-115183","published":"2026-10-25T06:16:32.143","last_modified":"2026-10-25T06:16:32.143","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after decoding HTML entities in it, allowing users with the Contributor role and above to embed live HTML forms, including password fields that submit to an external host","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115183"},{"cve_id":"CVE-2026-114743","published":"2026-10-25T06:16:32.037","last_modified":"2026-10-25T06:16:32.037","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The InstaWP Connect  WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect  WordPress plugin before 0.1.4.2-settings update action, verifying only a nonce, allowing an authenticated user holding a low-privileged role that an administrator has ","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114743"},{"cve_id":"CVE-2026-114742","published":"2026-10-25T06:16:31.930","last_modified":"2026-10-25T06:16:31.930","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The WPVR  WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours, allowing users with contributor-level access and above to modify, reconfigure and publish tours created by other users.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114742"},{"cve_id":"CVE-2026-114741","published":"2026-10-25T06:16:31.820","last_modified":"2026-10-25T06:16:31.820","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The WPVR  WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating virtual tours, allowing users with contributor-level access and above to read and modify tours created by other users.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114741"},{"cve_id":"CVE-2026-114740","published":"2026-10-25T06:16:31.703","last_modified":"2026-10-25T06:16:31.703","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The WPVR  WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its setup wizard, allowing users with the Contributor role and above to create and publish tour content and set arbitrary post metadata they could not otherwise create ","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114740"},{"cve_id":"CVE-2026-111981","published":"2026-10-25T06:16:31.597","last_modified":"2026-10-25T06:16:31.597","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The GiveWP  WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report (view) access but not donor-edit access to add, modify, or delete the stored address of any donor on the site.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111981"},{"cve_id":"CVE-2026-111980","published":"2026-10-25T06:16:31.490","last_modified":"2026-10-25T06:16:31.490","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The GiveWP  WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies to, allowing users with a custom fundraising role to edit, publish and read pages owned by other users, including administrators.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111980"},{"cve_id":"CVE-2026-111979","published":"2026-10-25T06:16:31.387","last_modified":"2026-10-25T06:16:31.387","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The GiveWP  WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP  WordPress plugin before 4.19.0.1 role to inject arbitrary","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111979"},{"cve_id":"CVE-2026-111978","published":"2026-10-25T06:16:31.273","last_modified":"2026-10-25T06:16:31.273","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The GiveWP  WordPress plugin before 4.19.0.1 does not properly validate a user-supplied filename before reading it from disk, allowing users with a high-privilege custom role to perform path traversal, disclose the contents of JSON-parseable files anywhere on the server, and over","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111978"},{"cve_id":"CVE-2026-111976","published":"2026-10-25T06:16:31.150","last_modified":"2026-10-25T06:16:31.150","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The GiveWP  WordPress plugin before 4.19.0.1 does not perform any status or capability check when rendering a donation form on a public front-end route, allowing unauthenticated visitors to view the content and settings of unpublished (draft, pending, private and scheduled) donat","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111976"},{"cve_id":"CVE-2026-110285","published":"2026-10-25T06:16:31.020","last_modified":"2026-10-25T06:16:31.020","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The WP Stripe Checkout WordPress plugin before 1.2.2.62 does not verify the Stripe webhook signature when no signing secret is configured, which is its default state, allowing unauthenticated attackers to forge a payment completion notification and create a completed order withou","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110285"},{"cve_id":"CVE-2025-15705","published":"2026-10-25T06:16:29.603","last_modified":"2026-10-25T06:16:29.603","vuln_status":"Received","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"The Contact Form by Supsystic  WordPress plugin before 1.8.0 does not sanitise and escape a form name, allowing users with access to the form editor to inject arbitrary web scripts that execute when another user views the form. On multisite installations, where administrators do ","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2025-15705"},{"cve_id":"CVE-2026-116007","published":"2026-10-25T04:17:34.610","last_modified":"2026-10-25T04:17:34.793","vuln_status":"Deferred","cvss_base_score":3.7,"cvss_severity":"LOW","description_excerpt":"A flaw has been found in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The impacted element is the function SmsCodeServiceImpl.validateSmsCode0 of the file /service/sms/SmsCodeServiceImpl.java of the component SMS Code Verification. This manipulation causes improper restricti","cwes_json":"[\"CWE-307\",\"CWE-799\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116007"},{"cve_id":"CVE-2026-116006","published":"2026-10-25T04:17:34.083","last_modified":"2026-10-25T04:17:34.503","vuln_status":"Deferred","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A vulnerability was detected in YunaiV/zhijiantianya ruoyi-vue-pro up to 2026.09. The affected element is an unknown function of the file AuthController.java of the component SMS Code Verification. The manipulation of the argument mobile/code results in improper authentication. T","cwes_json":"[\"CWE-287\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116006"},{"cve_id":"CVE-2026-116004","published":"2026-10-25T03:16:27.717","last_modified":"2026-10-25T03:16:27.863","vuln_status":"Deferred","cvss_base_score":3.5,"cvss_severity":"LOW","description_excerpt":"A security vulnerability has been detected in onyx-dot-app Onyx up to 5.0.0. Impacted is an unknown function of the file web/src/app/craft/components/output-panel/PreviewTab.tsx. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has","cwes_json":"[\"CWE-79\",\"CWE-94\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116004"},{"cve_id":"CVE-2026-116000","published":"2026-10-25T03:16:26.617","last_modified":"2026-10-25T03:16:26.617","vuln_status":"Received","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A security flaw has been discovered in Zylon PrivateGPT 1.0.0/1.0.1. This vulnerability affects the function load_file_from_uri of the file private_gpt/server/ingest/uri_loader.py of the component URI Artifact Loader. Performing a manipulation of the argument Value results in ser","cwes_json":"[\"CWE-918\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116000"},{"cve_id":"CVE-2026-115999","published":"2026-10-25T02:16:26.913","last_modified":"2026-10-25T02:16:26.913","vuln_status":"Received","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A vulnerability has been found in mansi-k Restaurant_IMS d7ad49f61ab7cc1ec6eb359ac2b5378bdbde0694. Affected is the function mysqli_connect of the file lsmodal.php. The manipulation of the argument login_id/epsw leads to sql injection. Remote exploitation of the attack is possible","cwes_json":"[\"CWE-74\",\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115999"},{"cve_id":"CVE-2026-115997","published":"2026-10-25T00:16:45.047","last_modified":"2026-10-25T00:16:46.110","vuln_status":"Deferred","cvss_base_score":6.3,"cvss_severity":"MEDIUM","description_excerpt":"A flaw has been found in pig-mesh pig up to 4.1.0. This impacts the function orderItem.getColumn of the file pig-common/pig-common-data/src/main/java/com/pig4cloud/pig/common/data/resolver/SqlFilterArgumentResolver.java. Executing a manipulation of the argument ascs/descs can lea","cwes_json":"[\"CWE-74\",\"CWE-89\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115997"},{"cve_id":"CVE-2026-89284","published":"2026-10-24T23:16:59.293","last_modified":"2026-10-24T23:16:59.293","vuln_status":"Rejected","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89284"},{"cve_id":"CVE-2026-115996","published":"2026-10-24T23:16:58.907","last_modified":"2026-10-24T23:16:58.907","vuln_status":"Received","cvss_base_score":3.7,"cvss_severity":"LOW","description_excerpt":"A vulnerability was detected in Unitree Robotics Unitree Go2 up to 1.1.13/1.1.14.1/1.1.15.1. This affects the function WebSocketClient.connect of the file websocket.py of the component chat_go. Performing a manipulation results in improper certificate validation. The attack may b","cwes_json":"[\"CWE-287\",\"CWE-295\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115996"},{"cve_id":"CVE-2026-115995","published":"2026-10-24T23:16:58.323","last_modified":"2026-10-24T23:16:58.323","vuln_status":"Received","cvss_base_score":9.6,"cvss_severity":"CRITICAL","description_excerpt":"A security vulnerability has been detected in Unitree Robotics Unitree Go2 up to 1.1.11.4. The impacted element is the function set_volume of the file gpt_thread.py of the component chat_go. Such manipulation of the argument Value leads to os command injection. The attack can be ","cwes_json":"[\"CWE-77\",\"CWE-78\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115995"},{"cve_id":"CVE-2026-111326","published":"2026-10-24T23:16:58.260","last_modified":"2026-10-24T23:16:58.260","vuln_status":"Rejected","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111326"},{"cve_id":"CVE-2026-109111","published":"2026-10-24T23:16:57.663","last_modified":"2026-10-24T23:16:57.663","vuln_status":"Rejected","cvss_base_score":null,"cvss_severity":null,"description_excerpt":"Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.","cwes_json":"[]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109111"},{"cve_id":"CVE-2026-115982","published":"2026-10-24T22:16:27.647","last_modified":"2026-10-24T22:16:27.793","vuln_status":"Deferred","cvss_base_score":4.3,"cvss_severity":"MEDIUM","description_excerpt":"A vulnerability was detected in phpIPAM up to 1.8.3. Affected by this issue is the function create_rack_link of the file app/tools/racks/show-rack-popup.php of the component Rack Link Creation. Performing a manipulation of the argument deviceid results in cross site scripting. Re","cwes_json":"[\"CWE-79\",\"CWE-94\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115982"},{"cve_id":"CVE-2026-115981","published":"2026-10-24T22:16:27.453","last_modified":"2026-10-24T22:16:27.600","vuln_status":"Deferred","cvss_base_score":2.4,"cvss_severity":"LOW","description_excerpt":"A security vulnerability has been detected in phpIPAM up to 1.8.3. Affected by this vulnerability is an unknown functionality of the file upgrade/index.php. Such manipulation of the argument REQUEST_URI leads to cross site scripting. The attack may be launched remotely. The explo","cwes_json":"[\"CWE-79\",\"CWE-94\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115981"},{"cve_id":"CVE-2026-115973","published":"2026-10-24T19:17:04.553","last_modified":"2026-10-24T19:17:04.697","vuln_status":"Deferred","cvss_base_score":7.3,"cvss_severity":"HIGH","description_excerpt":"A vulnerability was identified in FaveoSuite Faveo Helpdesk 2.0.3. Affected by this issue is the function ForgotPasswordController::sendResetLinkEmail/PasswordController::reset of the file app/Http/Controllers/Auth/ForgotPasswordController.php. The manipulation leads to weak pass","cwes_json":"[\"CWE-640\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115973"},{"cve_id":"CVE-2026-114820","published":"2026-10-24T19:17:04.413","last_modified":"2026-10-25T04:17:07.843","vuln_status":"Received","cvss_base_score":9.1,"cvss_severity":"CRITICAL","description_excerpt":"Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE).  Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17.0.21.0.2, 21.0.13.0.2, 25.0.5.0.2, 27.0","cwes_json":"[\"CWE-327\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114820"},{"cve_id":"CVE-2026-115972","published":"2026-10-24T18:16:48.730","last_modified":"2026-10-24T18:16:48.870","vuln_status":"Deferred","cvss_base_score":5.3,"cvss_severity":"MEDIUM","description_excerpt":"A vulnerability was determined in FaveoSuite Faveo Helpdesk up to 2.0.3. Affected by this vulnerability is the function UnAuthController.changeStatus/UnAuthController.close/UnAuthController.open/UnAuthController.resolve of the file app/Http/Controllers/Client/helpdesk/UnAuthContr","cwes_json":"[\"CWE-862\",\"CWE-863\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115972"},{"cve_id":"CVE-2026-115971","published":"2026-10-24T18:16:48.550","last_modified":"2026-10-24T18:16:48.550","vuln_status":"Received","cvss_base_score":5.3,"cvss_severity":"MEDIUM","description_excerpt":"A vulnerability was found in Travisun Opptrix 0.4.0. Affected is the function Buffer.concat of the file /api/channels/webhook/ of the component preParsing handler. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been m","cwes_json":"[\"CWE-404\"]","affected_products":"[]","nvd_url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115971"}]}