Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108124 | medium | 4.9 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp... | 2026-10-09 |
| CVE-2026-108109 | critical | 9.1 | No | PHPNuxBill through 2025.3.20 contains an account takeover vulnerability in the customer password reset flow in system/controllers/forgot.php... | 2026-10-09 |
| CVE-2026-108105 | medium | 5.9 | No | Open5GS through 2.8.0 contains a reachable assertion vulnerability in mme_gn_handle_sgsn_context_request() that allows remote unauthenticate... | 2026-10-09 |
| CVE-2026-107783 | medium | 5.9 | No | Insertion of sensitive information into log file in AWS Tools for PowerShell before 5.0.306 might allow local users to recover an IAM user's... | 2026-10-09 |
| CVE-2026-107803 | medium | 6.5 | No | ProcessMaker is an open source workflow management software suite. Prior to 2026.14.3, the `GET /api/1.0/tasks` endpoint in ProcessMaker is... | 2026-10-09 |
| CVE-2026-106155 | high | 8.9 | No | In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engin... | 2026-10-09 |
| CVE-2026-102554 | not reported | — | No | Allocation of resources without limits or throttling (CWE-770) during Java object deserialization in Google Guava versions 4.0 through 33.7.... | 2026-10-09 |
| CVE-2026-104081 | high | 8.1 | No | KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, wh... | 2026-10-09 |
| CVE-2026-105877 | not reported | — | No | Insertion of Sensitive Information Into Sent Data vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Retrieve Embedded Sensiti... | 2026-10-09 |
| CVE-2026-106145 | high | 7.1 | No | In Progress® Telerik® Report Server prior to version 12.2.26.1007, incorrect privilege assignment in the service-agent SignalR hub allows an... | 2026-10-09 |
| CVE-2026-101028 | not reported | — | No | Incorrect Authorization vulnerability in ash-project ash allows an actor to infer data in related records they cannot read via Ash.count/2,... | 2026-10-09 |
| CVE-2026-106261 | medium | 6.5 | No | Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to read memory inside the sandbox via a cr... | 2026-10-09 |
| CVE-2026-106280 | medium | 6.5 | No | Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially bypass web ori... | 2026-10-09 |
| CVE-2026-106289 | medium | 6.5 | No | Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted H... | 2026-10-09 |
| CVE-2026-106389 | medium | 6.5 | No | Incorrect authorization in USB in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass sys... | 2026-10-09 |
| CVE-2026-106397 | medium | 6.1 | No | Incorrect authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering... | 2026-10-09 |
| CVE-2026-106422 | medium | 4.3 | No | Incorrect authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted H... | 2026-10-09 |
| CVE-2026-106505 | high | 8.5 | No | Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package is af... | 2026-10-09 |
| CVE-2026-106216 | medium | 5.4 | No | Cross-site request forgery in ReadingList in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social... | 2026-10-09 |
| CVE-2026-106506 | medium | 5.3 | No | Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected... | 2026-10-09 |