Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107800 | medium | 5.4 | No | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private... | 2026-10-09 |
| CVE-2026-107797 | medium | 6.1 | No | Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to... | 2026-10-09 |
| CVE-2026-107793 | medium | 4.3 | No | Jivejdon through 5.0 contains an authorization bypass vulnerability in SubscriptionServiceImp.deleteSubscription that allows authenticated u... | 2026-10-09 |
| CVE-2026-106376 | medium | 4.7 | No | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the s... | 2026-10-09 |
| CVE-2026-106333 | medium | 5.4 | No | Incorrect authorization in Input in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI... | 2026-10-09 |
| CVE-2026-106334 | high | 8.8 | No | Information leak in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensi... | 2026-10-09 |
| CVE-2026-105275 | medium | 4.3 | No | Satel Netco Design versions prior to v2.1.7 contains a relative path traversal vulnerability in its data import functionality. An authentica... | 2026-10-09 |
| CVE-2026-105269 | medium | 6.8 | No | Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operato... | 2026-10-09 |
| CVE-2026-104628 | medium | 6.5 | No | Satel Netco Design versions prior to v2.1.7 contains an inefficient regular expression complexity vulnerability. An authenticated user with... | 2026-10-09 |
| CVE-2026-94063 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education al... | 2026-10-09 |
| CVE-2026-107831 | medium | 4.3 | No | Jivejdon through 5.0 contains a cross-site request forgery vulnerability that allows remote attackers to perform state-changing actions by a... | 2026-10-09 |
| CVE-2026-107715 | medium | 6.8 | No | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize sends caller-supplied credential headers... | 2026-10-09 |
| CVE-2026-106587 | low | 3.3 | No | In sshd in OpenSSH before 10.6, the value "none" for a configuration option is sometimes interpreted as a filename but was intended to mean... | 2026-10-09 |
| CVE-2026-107804 | medium | 5.3 | No | Nginx UI is a web user interface for the Nginx web server. From 2.2.0 until 2.6.0, the bundled reverse proxy does not preserve the external... | 2026-10-09 |
| CVE-2026-107714 | medium | 5.9 | No | The Mechanize library is used for automating interaction with websites. Prior to 2.14.1, Mechanize::HTTP::Agent#response_redirect treats red... | 2026-10-09 |
| CVE-2026-108063 | medium | 5.5 | No | A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongsi... | 2026-10-09 |
| CVE-2026-83428 | high | 8.1 | No | Vulnerability in the Oracle Demand Signal Repository product of Oracle E-Business Suite (component: Internal Operations). Supported versions... | 2026-10-09 |
| CVE-2026-83481 | high | 7.2 | No | Vulnerability in the Oracle Contracts product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affec... | 2026-10-09 |
| CVE-2026-97031 | high | 7.5 | No | Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could t... | 2026-10-09 |
| CVE-2026-78659 | high | 7.5 | No | When "Trailer" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to... | 2026-10-09 |