Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110136 | critical | 9.6 | No | Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a... | 2026-10-15 |
| CVE-2026-103851 | high | 7.8 | No | Substance3D - Stager is affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context... | 2026-10-15 |
| CVE-2026-78309 | high | 8.8 | No | SQL Injection vulnerability in DIAEnergie. This issue affects DIAEnergie: before 1.11.00.022. | 2026-10-15 |
| CVE-2026-109371 | high | 8.2 | No | ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler act... | 2026-10-15 |
| CVE-2026-109362 | medium | 5.4 | No | Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workf... | 2026-10-15 |
| CVE-2026-109342 | medium | 5.4 | No | SurrealDB from 3.0.0 before 3.3.0 contains a missing authentication vulnerability in the revoke RPC method that allows low-privileged or una... | 2026-10-15 |
| CVE-2026-109337 | medium | 4.3 | No | SurrealDB before 3.3.0 contains an authorization bypass vulnerability that allows record users to infer field values hidden by field-level S... | 2026-10-15 |
| CVE-2026-109332 | low | 3.1 | No | Network-AI (npm network-ai) before 5.15.2 contains an origin validation error in McpSseServer._handleRequest in lib/mcp-transport-sse.ts tha... | 2026-10-15 |
| CVE-2026-108906 | high | 7.2 | No | A vulnerability has been found in Netcore NR268 1.7.121109. This affects the function filter_arp_put_file_cgi of the file /router/filter_arp... | 2026-10-15 |
| CVE-2026-109200 | medium | 6.4 | No | LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetch... | 2026-10-15 |
| CVE-2026-96940 | high | 8.8 | No | Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | 2026-10-15 |
| CVE-2026-101027 | high | 7.7 | No | When `[migrations] ALLOWED_DOMAINS` was configured, a hostname matching the allow list was accepted without checking its resolved address ag... | 2026-10-15 |
| CVE-2026-101029 | medium | 4.3 | No | Gitea's repository migration and pull mirror egress checks could be bypassed with a hostname that returns multiple DNS answers, because the... | 2026-10-15 |
| CVE-2026-103059 | critical | 9.1 | No | When Gitea's built-in SSH server is enabled (`START_SSH_SERVER = true`), the presented public key was looked up with an SQL `LIKE` compariso... | 2026-10-15 |
| CVE-2026-103667 | medium | 5.4 | No | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without... | 2026-10-15 |
| CVE-2026-103670 | high | 7.5 | No | When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the n... | 2026-10-15 |
| CVE-2026-84854 | high | 7.0 | No | In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer cou... | 2026-10-15 |
| CVE-2026-78308 | critical | 9.8 | No | Improper Authentication vulnerability in DIAEnergie allows Authentication Bypass. This issue affects DIAEnergie: before 1.11.00.022. | 2026-10-15 |
| CVE-2026-84393 | high | 8.1 | No | A improper validation of certificate with host mismatch vulnerability in Fortinet FortiOS 7.6.1 through 7.6.6, FortiProxy 7.6.2 through 7.6.... | 2026-10-15 |
| CVE-2026-33920 | low | 3.5 | No | A cross-site request forgery vulnerability was discovered in the login functionality (both standard and SAML) due to missing validation of t... | 2026-10-15 |