Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106387 | high | 8.8 | No | Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to... | 2026-10-08 |
| CVE-2026-106395 | medium | 4.7 | No | Uninitialized resource in Dawn in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sa... | 2026-10-08 |
| CVE-2026-106399 | low | 3.3 | No | Out of bounds read in Skia in Google Chrome prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to potentially rea... | 2026-10-08 |
| CVE-2022-37897 | critical | 9.8 | No | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets des... | 2026-10-08 |
| CVE-2026-106424 | medium | 4.0 | No | Information leak in Audio in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read... | 2026-10-08 |
| CVE-2026-67411 | high | 7.1 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.18, 4.0.23, 4.1.14, 4.2.9, and 4.3.3, native MQTT and MQTT over WebSock... | 2026-10-08 |
| CVE-2026-67412 | high | 7.1 | No | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9 , 4.1.14, 4.0.24, and 3.13.18, Federation upstream in RabbitMQ... | 2026-10-08 |
| CVE-2026-100503 | medium | 5.5 | No | Ghidra versions through 12.1.4 contain a heap use-after-free vulnerability in the decompiler's Funcdata::opInsertAfter function caused by st... | 2026-10-08 |
| CVE-2026-100504 | high | 7.0 | No | Ghidra versions through 12.1.4 contain a stack-based out-of-bounds write vulnerability in the decompiler's leftshift128 function when proces... | 2026-10-08 |
| CVE-2026-100505 | medium | 4.4 | No | Ghidra versions 9.2 through 12.1.4 contain a heap out-of-bounds read vulnerability in StringManager::getCodepoint when decoding multi-byte U... | 2026-10-08 |
| CVE-2026-93988 | medium | 6.5 | No | QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-of... | 2026-10-08 |
| CVE-2026-93452 | high | 7.5 | No | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in Snappy.compress(ByteBuffer, ByteBuffer) that writes past the end of... | 2026-10-08 |
| CVE-2026-93451 | medium | 6.5 | No | snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompress*Array methods that allocate output arrays b... | 2026-10-08 |
| CVE-2026-92298 | medium | 4.8 | No | EspoCRM through 10.0.8 uses PHP's rand() function to generate tokens for lead-capture opt-in, event invitation, and campaign URLs instead of... | 2026-10-08 |
| CVE-2026-91991 | medium | 5.4 | No | Tornado before 6.5.8 contains an incomplete fix for cookie attribute injection that allows attackers to inject arbitrary cookie attributes b... | 2026-10-08 |
| CVE-2026-90936 | medium | 4.3 | No | Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can... | 2026-10-08 |
| CVE-2026-90935 | medium | 4.3 | No | Froxlor before 2.3.7 fails to validate the mysql_server parameter against a customer's allowed_mysqlserver allowlist in the Mysqls.add API c... | 2026-10-08 |
| CVE-2026-90559 | high | 7.5 | No | snappy-java through 1.1.10.8 contains an out-of-bounds write vulnerability in Snappy.uncompress(ByteBuffer, ByteBuffer) because destination... | 2026-10-08 |
| CVE-2026-88879 | high | 8.2 | No | Traefik is an HTTP reverse proxy and load balancer. In Traefik v1.x, v2.x through v2.11.55, and v3.0.0 through v3.7.11, header names are can... | 2026-10-08 |
| CVE-2026-88878 | medium | 5.3 | No | Traefik is an HTTP reverse proxy and load balancer. In versions >= v2.8.2 through <= v2.11.55 and >= v3.0.0 through <= v3.7.11, the entryPoi... | 2026-10-08 |