Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109756 | high | 8.8 | No | Privilege escalation in the DOM: Navigation component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-14 |
| CVE-2026-109709 | high | 8.8 | No | Information disclosure, privilege escalation in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 158, Fir... | 2026-10-14 |
| CVE-2026-103418 | high | 8.8 | No | Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to... | 2026-10-14 |
| CVE-2026-102869 | high | 8.8 | No | Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privilege... | 2026-10-14 |
| CVE-2026-102226 | high | 8.8 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Dynamics Business Central allows an authorized attacker to... | 2026-10-14 |
| CVE-2026-100214 | high | 8.8 | No | Deserialization of untrusted data in Dynamics Business Central allows an authorized attacker to execute code over a network. | 2026-10-14 |
| CVE-2026-84838 | high | 7.8 | No | A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs w... | 2026-10-14 |
| CVE-2026-84837 | high | 7.8 | No | A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processe... | 2026-10-14 |
| CVE-2026-48484 | medium | 6.5 | No | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the API `rpc` function in `api_blueprint.py` h... | 2026-10-14 |
| CVE-2026-108703 | medium | 5.4 | No | CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to su... | 2026-10-14 |
| CVE-2026-108678 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authen... | 2026-10-14 |
| CVE-2026-108673 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController exportXls handler that allows any authe... | 2026-10-14 |
| CVE-2026-108668 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragPromptsController deleteRecycleBin handler that allows an... | 2026-10-14 |
| CVE-2026-108663 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController deleteApply handler that allows any authen... | 2026-10-14 |
| CVE-2026-108658 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysTenantController queryTenantAuthInfo handler that allows an... | 2026-10-14 |
| CVE-2026-108653 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryPageList handler of OpenApiController that allows any aut... | 2026-10-14 |
| CVE-2026-108648 | medium | 6.5 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/api/getDynamicDbSourceByCode endpoint of SystemApiCon... | 2026-10-14 |
| CVE-2026-108643 | medium | 5.4 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete category dic... | 2026-10-14 |
| CVE-2026-108638 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove group member... | 2026-10-14 |
| CVE-2026-108633 | medium | 4.3 | No | JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department p... | 2026-10-14 |