Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100785 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Th... | 2026-10-05 |
| CVE-2026-100786 | critical | 9.6 | No | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderb... | 2026-10-05 |
| CVE-2026-88779 | high | 7.5 | Listed | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS,... | 2026-10-05 |
| CVE-2026-100787 | critical | 9.6 | No | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 2026-10-05 |
| CVE-2026-56154 | critical | 9.8 | No | Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Ser... | 2026-10-05 |
| CVE-2026-57941 | critical | 9.8 | No | Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server:... | 2026-10-05 |
| CVE-2026-58415 | medium | 5.3 | No | Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all plat... | 2026-10-05 |
| CVE-2026-59685 | high | 7.5 | No | Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This... | 2026-10-05 |
| CVE-2026-5782 | medium | 5.2 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co.... | 2026-10-05 |
| CVE-2026-59797 | critical | 9.8 | No | Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects... | 2026-10-05 |
| CVE-2026-63045 | high | 7.5 | No | Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo... | 2026-10-05 |
| CVE-2026-103488 | high | 7.1 | No | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re... | 2026-10-05 |
| CVE-2026-103489 | medium | 5.4 | No | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | 2026-10-05 |
| CVE-2026-103490 | high | 7.2 | No | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | 2026-10-05 |
| CVE-2026-80276 | high | 7.5 | No | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface... | 2026-10-05 |
| CVE-2026-80275 | high | 8.8 | No | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an a... | 2026-10-05 |
| CVE-2026-81793 | medium | 6.5 | No | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Acc... | 2026-10-05 |
| CVE-2026-39601 | low | 3.7 | No | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar book... | 2026-10-05 |
| CVE-2026-93495 | not reported | — | No | Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a... | 2026-10-05 |
| CVE-2026-104470 | medium | 5.0 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs v... | 2026-10-04 |