Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-67269 | critical | 9.9 | No | Dell Container Storage Modules (CSM) Operator, versions prior to 1.18.0 contains an Improper Privilege Management vulnerability in the Conta... | 2026-10-08 |
| CVE-2026-17196 | high | 8.8 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Unrestricted File Type Upload in all versions up to, and in... | 2026-10-08 |
| CVE-2026-103360 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to improper limitation... | 2026-10-08 |
| CVE-2026-107638 | medium | 6.8 | No | pH7Builder (pH7 Social Dating CMS) before 18.5.0 contains an improper restriction of authentication attempts vulnerability that allows attac... | 2026-10-08 |
| CVE-2026-107636 | medium | 6.5 | No | pH7Builder (pH7 Social Dating CMS) before 18.5.1 contains a payment validation vulnerability that allows registered low-privileged members t... | 2026-10-08 |
| CVE-2026-105833 | high | 7.7 | No | EspoCRM before 10.0.5 contains an insecure direct object reference vulnerability in PersonalAccount\Service that allows users with Email Acc... | 2026-10-08 |
| CVE-2026-106611 | high | 7.1 | No | Cross-Site Request Forgery (CSRF) vulnerability in WPMU DEV Forminator forminator allows Cross Site Request Forgery.This issue affects Formi... | 2026-10-08 |
| CVE-2026-106603 | medium | 6.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in Groundhogg HollerBox holler-box allows Exploiting Incorrectly Configured A... | 2026-10-08 |
| CVE-2026-105888 | medium | 5.4 | No | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Co... | 2026-10-08 |
| CVE-2026-105831 | medium | 4.3 | No | EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting craf... | 2026-10-08 |
| CVE-2026-103072 | medium | 4.3 | No | Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-08 |
| CVE-2026-101331 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to insufficiently prot... | 2026-10-08 |
| CVE-2026-93677 | medium | 6.5 | No | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information due to exposure of sensiti... | 2026-10-08 |
| CVE-2026-106322 | medium | 6.1 | No | Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web o... | 2026-10-08 |
| CVE-2026-106427 | medium | 5.4 | No | Confused deputy in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions i... | 2026-10-08 |
| CVE-2026-106288 | medium | 5.4 | No | Missing authorization in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass s... | 2026-10-08 |
| CVE-2026-106259 | medium | 5.4 | No | Incorrect authorization in PermissionElement in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass system access restr... | 2026-10-08 |
| CVE-2023-3079 | high | 8.8 | Listed | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted... | 2026-10-08 |
| CVE-2026-106271 | high | 8.1 | No | Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process... | 2026-10-08 |
| CVE-2026-106263 | medium | 6.5 | No | Improper input validation in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypas... | 2026-10-08 |