Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106284 | medium | 4.7 | No | Out of bounds read in Printing in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker who had compromised the rende... | 2026-10-08 |
| CVE-2026-106273 | medium | 4.7 | No | Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process t... | 2026-10-08 |
| CVE-2026-106275 | medium | 4.7 | No | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the san... | 2026-10-08 |
| CVE-2026-106274 | high | 8.8 | No | Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engi... | 2026-10-08 |
| CVE-2026-106258 | medium | 4.7 | No | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the s... | 2026-10-08 |
| CVE-2026-106272 | medium | 5.4 | No | UI misrepresentation in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker leveraging social enginee... | 2026-10-08 |
| CVE-2026-103371 | high | 7.5 | No | Insertion of Sensitive Information into Log File in Apache Geode Web Management. This issue affects Apache Geode: from 2.0.0 before 2.0.3.... | 2026-10-08 |
| CVE-2026-71896 | medium | 6.5 | No | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to retrieve other users' account information through th... | 2026-10-08 |
| CVE-2026-71895 | high | 7.1 | No | An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data int... | 2026-10-08 |
| CVE-2026-71183 | high | 7.1 | No | An authorization vulnerability in Apache DolphinScheduler allows authenticated users to obtain information about data sources they are not a... | 2026-10-08 |
| CVE-2026-94154 | medium | 6.1 | No | The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and incl... | 2026-10-08 |
| CVE-2026-96335 | high | 7.5 | No | Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This is... | 2026-10-08 |
| CVE-2026-95606 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Liquid Web / StellarWP The Events Calendar allows Object Injection. This issue affects T... | 2026-10-08 |
| CVE-2026-95605 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate Programmer Peter WP Data Ac... | 2026-10-08 |
| CVE-2026-95595 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google... | 2026-10-08 |
| CVE-2026-95534 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) all... | 2026-10-08 |
| CVE-2026-94670 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS. T... | 2026-10-08 |
| CVE-2026-94662 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements... | 2026-10-08 |
| CVE-2026-42698 | medium | 5.3 | No | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Themeum Tutor LMS tutor allows... | 2026-10-08 |
| CVE-2026-27420 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows... | 2026-10-08 |