Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103104 | high | 7.5 | No | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a re... | 2026-10-05 |
| CVE-2026-103105 | high | 8.8 | No | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper access control on a product-internal API which allows an attac... | 2026-10-05 |
| CVE-2026-103106 | high | 7.8 | No | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation within an internal Pexip Infinity service th... | 2026-10-05 |
| CVE-2026-103108 | high | 7.5 | No | Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a re... | 2026-10-05 |
| CVE-2026-103109 | critical | 9.4 | No | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a rem... | 2026-10-05 |
| CVE-2026-103110 | critical | 9.8 | No | Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation that allows a remote attacker to execute code... | 2026-10-05 |
| CVE-2026-94484 | medium | 4.8 | No | Next.js is a React framework for building full-stack web applications. From 15.0.0 until 15.5.27 and 16.3.8, applications with a root-level... | 2026-10-05 |
| CVE-2026-28659 | high | 7.8 | No | In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escala... | 2026-10-05 |
| CVE-2026-105637 | critical | 9.6 | No | Plane is an open-source project management tool. Prior to 1.4.0, ProjectBulkAssetEndpoint.post in apps/api/plane/app/views/asset/v2.py retri... | 2026-10-05 |
| CVE-2026-105632 | not reported | — | No | Plane is an open-source project management tool. Prior to 1.4.0, the GraphQL joinProject mutation lets any workspace member add themselves t... | 2026-10-05 |
| CVE-2026-104979 | high | 8.7 | No | Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html thr... | 2026-10-05 |
| CVE-2026-104974 | high | 8.1 | No | Plane is an open-source project management tool. Prior to 1.4.0, a user whose account has been deactivated by setting is_active=False can st... | 2026-10-05 |
| CVE-2026-104968 | not reported | — | No | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns w... | 2026-10-05 |
| CVE-2026-104964 | medium | 6.8 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane's project update endpoint authorizes the caller against the workspace... | 2026-10-05 |
| CVE-2026-104956 | medium | 5.3 | No | Plane is an open-source project management tool. Prior to 1.4.0, the unauthenticated public issues endpoint accepts group_by and sub_group_b... | 2026-10-05 |
| CVE-2026-104851 | high | 8.8 | No | fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.r... | 2026-10-05 |
| CVE-2026-92067 | high | 8.8 | No | Use-after-free in the Widget: Gtk component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbir... | 2026-10-05 |
| CVE-2026-92068 | medium | 5.4 | No | Site isolation issue in the Reader Mode component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thun... | 2026-10-05 |
| CVE-2026-92069 | medium | 5.4 | No | Spoofing issue in the DOM: Navigation component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunde... | 2026-10-05 |
| CVE-2026-92070 | medium | 4.3 | No | Information disclosure in the Networking component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thu... | 2026-10-05 |