Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104971 | high | 8.5 | No | Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to th... | 2026-10-05 |
| CVE-2026-104967 | medium | 5.4 | No | Plane is an open-source project management tool. Prior to 1.4.0, BulkDeleteIssuesEndpoint and SubIssuesEndpoint in apps/api/plane/app/views/... | 2026-10-05 |
| CVE-2026-104962 | medium | 6.5 | No | Plane is an open-source project management tool. Prior to 1.4.0, GET /api/v1/workspaces/{slug}/projects/{project_id}/members/ returns the co... | 2026-10-05 |
| CVE-2026-104894 | medium | 4.3 | No | Plane is an open-source project management tool. Prior to 1.4.0, the modules endpoint accepts issue UUIDs in the URL path without validating... | 2026-10-05 |
| CVE-2026-103880 | high | 7.5 | No | Asymmetric Resource Consumption vulnerability in Apache Directory LDAP API. Storing a password using the bcrypt algorithm with a high force... | 2026-10-05 |
| CVE-2026-104056 | critical | 9.8 | No | Authlib version 1.7.2 and below contains a vulnerability where discovery JSON metadata is cached without validation or issuer-origin binding... | 2026-10-05 |
| CVE-2026-103878 | high | 7.5 | No | Cleartext transmission of sensitive information vulnerability in Apache Directory LDAP API. A StartTLS extended operation started after a S... | 2026-10-05 |
| CVE-2026-102731 | high | 7.5 | No | Memory allocation with excessive size value vulnerability in Apache Directory LDAP API. A malicious peer (or a MITM) can send a small BER-e... | 2026-10-05 |
| CVE-2026-92078 | medium | 6.5 | No | Denial-of-service in the Security component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbir... | 2026-10-05 |
| CVE-2026-92079 | critical | 9.1 | No | Mitigation bypass in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thund... | 2026-10-05 |
| CVE-2026-92057 | critical | 9.1 | No | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and... | 2026-10-05 |
| CVE-2026-92058 | high | 8.8 | No | Use-after-free in the Graphics component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbird 1... | 2026-10-05 |
| CVE-2026-92059 | critical | 9.3 | No | Incorrect boundary conditions in the DOM: Editor component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156,... | 2026-10-05 |
| CVE-2026-92060 | high | 8.8 | No | Use-after-free in the Internationalization component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and T... | 2026-10-05 |
| CVE-2026-92061 | critical | 9.8 | No | Incorrect boundary conditions in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 156 and Thunderbird 156... | 2026-10-05 |
| CVE-2026-92062 | high | 8.8 | No | Privilege escalation in the Session Restore component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and... | 2026-10-05 |
| CVE-2026-92063 | medium | 6.5 | No | Denial-of-service in the Audio/Video component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | 2026-10-05 |
| CVE-2026-92064 | high | 8.8 | No | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR... | 2026-10-05 |
| CVE-2026-92065 | high | 8.8 | No | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR... | 2026-10-05 |
| CVE-2026-92066 | critical | 9.8 | No | Sandbox escape in the Profile Backup component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | 2026-10-05 |