Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110143 | medium | 4.3 | No | Use of uninitialized variable in ThirdParty lmza_sdk in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to potentially read m... | 2026-10-14 |
| CVE-2026-110141 | low | 3.1 | No | Observable discrepancy in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to leak cross-origin data via a crafted HT... | 2026-10-14 |
| CVE-2026-110139 | high | 8.8 | No | Use after free in Media in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-10-14 |
| CVE-2026-56590 | critical | 9.8 | No | HCL BigFix Service Management is affected by an Unrestricted File Upload vulnerability due to improper file validation controls, which could... | 2026-10-14 |
| CVE-2026-110158 | high | 8.3 | No | Use after free in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process to ex... | 2026-10-14 |
| CVE-2026-110160 | medium | 4.2 | No | Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer proc... | 2026-10-14 |
| CVE-2026-21848 | medium | 5.0 | No | HCL BigFix Service Management is affected by a Security Misconfiguration vulnerability, which could allow an authenticated attacker to explo... | 2026-10-14 |
| CVE-2026-56592 | critical | 9.8 | No | HCL BigFix Service Management is affected by an Improper Authentication validation vulnerability related to inadequate account lockouts, whi... | 2026-10-14 |
| CVE-2026-56595 | medium | 4.3 | No | HCL BigFix Service Management is affected by a CORS Misconfiguration vulnerability due to improperly validated origin headers, which could a... | 2026-10-14 |
| CVE-2026-110170 | medium | 4.3 | No | Use after free in Bindings in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to read memory inside the sandbox via a crafted... | 2026-10-14 |
| CVE-2026-56597 | medium | 5.3 | No | HCL BigFix Service Management is affected by a Sensitive Information Leakage vulnerability, which could allow an unauthenticated attacker to... | 2026-10-14 |
| CVE-2026-21806 | critical | 9.8 | No | HCL BigFix Service Management is affected by an Administrative Session Concurrency vulnerability. The application allows multiple simultaneo... | 2026-10-14 |
| CVE-2026-84994 | not reported | — | No | Qwik is a performance-focused JavaScript framework. Prior to @builder.io/qwik 1.20.0 and @qwik.dev/core 2.0.0-beta.37, default server-side q... | 2026-10-14 |
| CVE-2026-77816 | medium | 6.5 | No | IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.9 administrative client could allow man-in-the-middle attacks. An attacke... | 2026-10-14 |
| CVE-2026-73793 | high | 7.9 | No | HPE NonStop Middleware software has secret key handling and data deserialization vulnerability. | 2026-10-14 |
| CVE-2026-35161 | medium | 5.3 | No | Dell PowerScale InsightIQ, versions 5.2.0 through 6.3.0, contains an Overly Restrictive Account Lockout Mechanism vulnerability. An unauthen... | 2026-10-14 |
| CVE-2026-110624 | low | 3.1 | No | Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and... | 2026-10-14 |
| CVE-2026-14855 | medium | 6.4 | No | The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'css[left]' parameter in all versions up to, and... | 2026-10-14 |
| CVE-2026-110619 | medium | 4.8 | No | frp 0.41.0 through 0.71.1 contains a missing authentication vulnerability that allows unauthenticated remote attackers to access pprof debug... | 2026-10-14 |
| CVE-2026-110604 | low | 3.6 | No | Mini-XML 4.0.0 through 4.0.6 contains an off-by-one stack out-of-bounds write in mxml_strtod() when the locale decimal point is not '.'. Att... | 2026-10-14 |