Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15176 | high | 8.1 | No | A vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite... | 2026-10-15 |
| CVE-2026-108066 | low | 2.7 | No | The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authenticatio... | 2026-10-15 |
| CVE-2026-106469 | medium | 6.8 | No | The Gutenverse Form WordPress plugin before 3.0.11 does not sanitize SVG icon markup stored in its form blocks before it is decoded and inse... | 2026-10-15 |
| CVE-2026-101216 | medium | 6.6 | No | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command... | 2026-10-15 |
| CVE-2026-101215 | medium | 6.6 | No | Dell Unisphere for PowerMax vApp, version(s) 9.2.4.x, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS C... | 2026-10-15 |
| CVE-2026-39781 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document... | 2026-10-15 |
| CVE-2026-4800 | critical | 9.8 | No | The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports k... | 2026-10-15 |
| CVE-2026-92908 | high | 8.3 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. A low-privileged atta... | 2026-10-15 |
| CVE-2026-71184 | high | 8.8 | No | Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does n... | 2026-10-15 |
| CVE-2026-66877 | high | 8.1 | No | Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's a... | 2026-10-15 |
| CVE-2026-60010 | medium | 6.5 | No | Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a r... | 2026-10-15 |
| CVE-2026-59774 | critical | 9.8 | No | Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server... | 2026-10-15 |
| CVE-2026-110172 | high | 8.8 | No | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-10-15 |
| CVE-2026-110171 | high | 8.8 | No | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-10-15 |
| CVE-2026-110169 | high | 8.8 | No | Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-10-15 |
| CVE-2026-110168 | high | 8.8 | No | Use after free in V8 in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-10-15 |
| CVE-2026-110167 | high | 8.8 | No | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-10-15 |
| CVE-2026-110166 | high | 8.8 | No | Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox... | 2026-10-15 |
| CVE-2026-110165 | critical | 9.6 | No | Use after free in Core in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code... | 2026-10-15 |
| CVE-2026-110164 | high | 8.8 | No | Use after free in DOM in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code inside the san... | 2026-10-15 |