Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92047 | high | 8.8 | No | Privilege escalation in the Crash Reporting component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and... | 2026-10-05 |
| CVE-2026-92048 | critical | 9.0 | No | Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR... | 2026-10-05 |
| CVE-2026-92049 | high | 8.8 | No | Use-after-free in the Widget: Win32 component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderb... | 2026-10-05 |
| CVE-2026-92050 | critical | 9.1 | No | Sandbox escape due to race condition in the XPConnect component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | 2026-10-05 |
| CVE-2026-92051 | critical | 9.1 | No | Spoofing issue due to invalid pointer in the Graphics component. This vulnerability was fixed in Firefox 156 and Thunderbird 156. | 2026-10-05 |
| CVE-2026-92052 | high | 8.8 | No | Privilege escalation due to uninitialized memory in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefo... | 2026-10-05 |
| CVE-2026-92053 | high | 8.8 | No | Privilege escalation in the Graphics: CanvasWebGL component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156... | 2026-10-05 |
| CVE-2026-73783 | medium | 4.9 | No | Stack overflow vulnerabilities exist in an API endpoint of AOS-CX. Successful exploitation could allow an authenticated malicious actor to c... | 2026-10-05 |
| CVE-2026-92054 | high | 8.8 | No | Privilege escalation in the Memory component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunderbi... | 2026-10-05 |
| CVE-2026-92055 | high | 8.8 | No | Privilege escalation in the DevTools component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunder... | 2026-10-05 |
| CVE-2026-92056 | high | 8.8 | No | Use-after-free in the Graphics: Text component. This vulnerability was fixed in Firefox 156, Firefox ESR 153.3, Thunderbird 156, and Thunder... | 2026-10-05 |
| CVE-2026-92608 | high | 7.5 | No | Improper handling of property-encoding exceptions in AMQP 1.0-to-AMQP 0-10 message conversion allows authenticated message producers to disr... | 2026-10-05 |
| CVE-2026-92550 | high | 7.5 | No | A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service.... | 2026-10-05 |
| CVE-2026-86930 | critical | 9.1 | No | An out-of-bounds read vulnerability in FileMaker Server for Linux allowed an attacker uploading a specially crafted image file to a containe... | 2026-10-05 |
| CVE-2026-86934 | critical | 9.1 | No | An authorization bypass vulnerability in the FileMaker Server Web Publishing Engine allowed requests containing an extended privilege header... | 2026-10-05 |
| CVE-2026-105628 | high | 7.6 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane's OAuth avatar synchronization flow fetches avatar_url from provider... | 2026-10-05 |
| CVE-2026-104994 | low | 2.5 | No | Trivy before 0.71.0 allows directory traversal in Terraform filesystem functions when they try to access pathnames above the scan root. The... | 2026-10-05 |
| CVE-2026-104969 | medium | 6.5 | No | Plane is an open-source project management tool. Prior to 1.4.0, the cycle-issues endpoint accepts issue UUIDs in the request body without v... | 2026-10-05 |
| CVE-2026-104965 | medium | 5.4 | No | Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without... | 2026-10-05 |
| CVE-2026-104960 | medium | 6.5 | No | Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/{workspace... | 2026-10-05 |