Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106381 | medium | 6.5 | No | Incorrect authorization in Passwords in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy... | 2026-10-13 |
| CVE-2026-106297 | medium | 4.3 | No | Incorrect authorization in Scheduling in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a cr... | 2026-10-13 |
| CVE-2026-106418 | medium | 6.5 | No | Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass w... | 2026-10-13 |
| CVE-2026-106555 | high | 7.5 | No | In sshd in OpenSSH before 10.6, GSSAPIAuthentication authentication state can incorrectly be persisted across authentication attempts. | 2026-10-13 |
| CVE-2026-106582 | low | 3.7 | No | In sshd and ssh in OpenSSH before 10.6, an LZ77 dictionary coder can be used even though this is contraindicated by the arXiv 2609.07709 "Cr... | 2026-10-13 |
| CVE-2026-106584 | low | 3.3 | No | In ssh-keygen in OpenSSH before 10.6, certificates could have incorrect expiration times because of Daylight Saving mishandling. There can b... | 2026-10-13 |
| CVE-2026-106586 | medium | 4.3 | No | In sshd in OpenSSH before 10.6, the restrict keyword (in authorized_keys) was supposed to be applicable to tunnel forwarding but was not, a... | 2026-10-13 |
| CVE-2026-101023 | critical | 9.1 | No | Gitea's OAuth2 token endpoint verified the signature and grant of a token submitted with the `refresh_token` grant type, but not that the to... | 2026-10-13 |
| CVE-2026-104633 | medium | 6.5 | No | When migrating a repository from another Gitea instance, Gitea used the page size reported in the source server's API settings to end its pa... | 2026-10-13 |
| CVE-2026-105267 | high | 8.1 | No | The Gitea web route for deleting tags (`POST /{owner}/{repo}/tags/delete`) requires only write access to the Code unit, but shares its handl... | 2026-10-13 |
| CVE-2026-105268 | medium | 4.3 | No | The Gitea API routes for issue attachments (`/api/v1/repos/{owner}/{repo}/issues/{index}/assets/{attachment_id}`) also accepted attachments... | 2026-10-13 |
| CVE-2026-106500 | high | 8.5 | No | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-back... | 2026-10-13 |
| CVE-2026-106501 | critical | 9.6 | No | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-back... | 2026-10-13 |
| CVE-2026-106502 | medium | 5.3 | No | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package could expose... | 2026-10-13 |
| CVE-2026-106503 | high | 8.1 | No | Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-back... | 2026-10-13 |
| CVE-2026-107286 | high | 7.5 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 2.10.0 until 2.53.0, streamed reque... | 2026-10-13 |
| CVE-2026-107387 | medium | 5.5 | No | music-metadata is a metadata parser for audio and video media files. Prior to 11.16.0, the APEv2 parser reads an attacker-controlled tag-ite... | 2026-10-13 |
| CVE-2026-107288 | low | 3.7 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, th... | 2026-10-13 |
| CVE-2026-107289 | medium | 6.8 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.56.0 until 1.107.6 and 2.44.0, ap... | 2026-10-13 |
| CVE-2026-107290 | medium | 6.5 | No | Pydantic AI is a Python agent framework for building applications and workflows with Generative AI. From 1.77.0 until 1.107.6 and 2.44.0, th... | 2026-10-13 |