Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110378 | medium | 5.3 | No | Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exp... | 2026-10-15 |
| CVE-2026-109897 | medium | 5.4 | No | Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Cont... | 2026-10-15 |
| CVE-2026-110715 | medium | 6.1 | No | MuJS 1.3.6 before 1.3.9 contains a heap out-of-bounds read and write vulnerability in Array.prototype.sort that allows attackers to corrupt... | 2026-10-15 |
| CVE-2026-109776 | medium | 4.2 | No | Race condition in the XPCOM component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.... | 2026-10-15 |
| CVE-2026-109757 | high | 8.3 | No | Sandbox escape due to race condition in the Networking component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbir... | 2026-10-15 |
| CVE-2026-109755 | critical | 9.6 | No | Sandbox escape in the DOM: Content Processes component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-15 |
| CVE-2026-109753 | high | 8.1 | No | Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, T... | 2026-10-15 |
| CVE-2026-109733 | high | 8.1 | No | JIT miscompilation in the JavaScript Engine: JIT component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153... | 2026-10-15 |
| CVE-2026-109730 | high | 8.8 | No | Integer overflow in the Graphics component. This vulnerability was fixed in Firefox 158, Firefox ESR 115.43, Firefox ESR 153.5, Thunderbird... | 2026-10-15 |
| CVE-2026-109723 | medium | 5.4 | No | Integer overflow in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, a... | 2026-10-15 |
| CVE-2026-109714 | medium | 5.4 | No | Incorrect boundary conditions in the Layout component. This vulnerability was fixed in Firefox 158 and Thunderbird 158. | 2026-10-15 |
| CVE-2026-109506 | not reported | — | No | Multiple TP-Link Wi-Fi range extenders use a custom, reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An... | 2026-10-15 |
| CVE-2026-108185 | high | 7.4 | No | Improper certificate validation in the My Notes feature of certain Zoom Clients may allow an unauthenticated user to conduct an information... | 2026-10-15 |
| CVE-2026-108184 | high | 7.4 | No | Improper certificate validation in certain Zoom Clients for Windows may allow an unauthenticated user to conduct an information disclosure v... | 2026-10-15 |
| CVE-2026-103083 | medium | 5.4 | No | Authorization Bypass Through User-Controlled Key vulnerability in ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attrib... | 2026-10-15 |
| CVE-2026-102946 | critical | 9.1 | No | joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. Prior to 1.7.4,... | 2026-10-15 |
| CVE-2026-0321 | not reported | — | No | Denial of service vulnerabilities in Palo Alto Networks PAN-OS® software allow an unauthenticated attacker with network access to cause a de... | 2026-10-15 |
| CVE-2026-66071 | medium | 6.5 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.22 and 4.1.11 and 4.2.6 and 4.3.1, Atom exhaustion: OAuth2 J... | 2026-10-15 |
| CVE-2025-14141 | critical | 9.8 | No | A flaw has been found in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formArpBindConfig. Exec... | 2026-10-15 |
| CVE-2026-57847 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-15 |