Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106338 | medium | 5.4 | No | UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address ba... | 2026-10-07 |
| CVE-2026-106321 | medium | 4.3 | No | Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitiv... | 2026-10-07 |
| CVE-2026-106320 | medium | 4.2 | No | Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to... | 2026-10-07 |
| CVE-2026-106329 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to pot... | 2026-10-07 |
| CVE-2026-106325 | medium | 4.3 | No | Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to le... | 2026-10-07 |
| CVE-2026-105111 | medium | 4.7 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happen... | 2026-10-07 |
| CVE-2026-102101 | high | 8.1 | No | Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could,... | 2026-10-07 |
| CVE-2026-97294 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant... | 2026-10-07 |
| CVE-2026-42721 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-to... | 2026-10-07 |
| CVE-2026-42720 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dyn... | 2026-10-07 |
| CVE-2026-27434 | medium | 5.3 | No | Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Securi... | 2026-10-07 |
| CVE-2026-105884 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-... | 2026-10-07 |
| CVE-2026-105876 | medium | 5.3 | No | Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This i... | 2026-10-07 |
| CVE-2026-105875 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Ele... | 2026-10-07 |
| CVE-2026-105873 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons... | 2026-10-07 |
| CVE-2026-105871 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons... | 2026-10-07 |
| CVE-2026-104393 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ... | 2026-10-07 |
| CVE-2026-104391 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master qui... | 2026-10-07 |
| CVE-2026-104390 | medium | 4.3 | No | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-07 |
| CVE-2026-103075 | medium | 4.3 | No | Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-07 |