Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107169 | medium | 6.2 | No | A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dere... | 2026-10-10 |
| CVE-2026-107162 | medium | 6.8 | No | Express Gateway through 1.16.11 contains an authentication bypass vulnerability in the OAuth 2.0 refresh_token grant that fails to validate... | 2026-10-10 |
| CVE-2026-107151 | medium | 5.9 | No | Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callb... | 2026-10-10 |
| CVE-2026-106059 | high | 8.8 | No | GitAhead through 2.7.1 on macOS contains a command injection vulnerability that allows attackers to execute shell commands by crafting repos... | 2026-10-10 |
| CVE-2026-101886 | medium | 4.0 | No | Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 contains a path traversal vulnerability that allows a malicious app with no per... | 2026-10-10 |
| CVE-2026-107570 | low | 2.5 | No | heap OOB write in convert_file_from_to() via a crafted Content-Type header allows attacker to OOB write when email is used as a template. | 2026-10-10 |
| CVE-2026-106237 | critical | 9.6 | No | Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTM... | 2026-10-09 |
| CVE-2026-106195 | critical | 9.1 | No | Incorrect authorization in Chromoting in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access re... | 2026-10-09 |
| CVE-2026-102916 | not reported | — | No | A reachable assertion in the illumos bhyve instruction emulator allows a guest to panic the host. When emulating a REP-prefixed MOVS or STOS... | 2026-10-09 |
| CVE-2026-96671 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Cross Site Request Forger... | 2026-10-09 |
| CVE-2026-96461 | high | 7.5 | No | Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-10-09 |
| CVE-2026-96332 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-paymen... | 2026-10-09 |
| CVE-2026-96327 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in VibeThemes WPLMS wplms_plugin allows B... | 2026-10-09 |
| CVE-2026-95599 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Taskbuilder Taskbuilder taskbuilder al... | 2026-10-09 |
| CVE-2026-95589 | medium | 6.5 | No | Missing Authorization vulnerability in Magepeople inc. Deposits and Partial Payments for WooCommerce advanced-partial-payment-or-deposit-for... | 2026-10-09 |
| CVE-2026-94664 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in add-ons.org PDF for Contact Form 7 pdf-for-c... | 2026-10-09 |
| CVE-2026-94568 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in WP Hosting AS Pay with Vipps for WooCommerce woo-vipps allows Object Injection.This issue... | 2026-10-09 |
| CVE-2026-94166 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core all... | 2026-10-09 |
| CVE-2026-79363 | medium | 5.9 | No | Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administra... | 2026-10-09 |
| CVE-2026-75346 | high | 7.5 | No | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master through commit 76b95cf in the server-side CIP SetAttribut... | 2026-10-09 |