Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79699 | medium | 4.4 | No | A flaw was found in the containers/storage library. A crafted tar archive containing a malicious whiteout header (e.g. victim/.wh.) can caus... | 2026-10-02 |
| CVE-2026-104472 | high | 7.5 | No | YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers... | 2026-10-02 |
| CVE-2026-104468 | medium | 4.8 | No | YesWiki before 4.6.7 contains an insufficient session expiration vulnerability that allows attackers to reuse old password reset links becau... | 2026-10-02 |
| CVE-2026-104466 | medium | 5.4 | No | YesWiki before 4.6.7 contains a stored cross-site scripting vulnerability in formatters/wakka.php that allows users who can edit pages or po... | 2026-10-02 |
| CVE-2026-104464 | high | 8.6 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make server-side GET requ... | 2026-10-02 |
| CVE-2026-104462 | high | 7.5 | No | YesWiki before 4.6.7 contains an SQL injection vulnerability in the Bazar nuagetag action, which concatenates the unescaped tags attribute i... | 2026-10-02 |
| CVE-2026-104460 | high | 7.5 | No | YesWiki before 4.6.7 contains a blind SQL injection vulnerability in the {{newtextsearch}} action because Bazar list option ids are concaten... | 2026-10-02 |
| CVE-2026-104458 | medium | 6.5 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability in validateKeyIdUrl() that allows unauthenticated attackers to byp... | 2026-10-02 |
| CVE-2026-104456 | high | 7.6 | No | YesWiki before 4.6.7 contains a second-order SQL injection vulnerability in AclService::updateRequestWithACL, where a stored username is con... | 2026-10-02 |
| CVE-2026-104454 | medium | 5.3 | No | YesWiki before 4.6.7 contains an algorithmic-complexity denial of service in the wakka.php formatter due to an O(n^2) markdown-link regex. U... | 2026-10-02 |
| CVE-2026-104452 | medium | 5.4 | No | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the filemanager page handler, which deletes page attachments on... | 2026-10-02 |
| CVE-2026-104450 | medium | 6.5 | No | YesWiki before 4.6.7 contains a missing authorization flaw in the pointimage action (tools/attach/actions/pointimage.php), which saves conte... | 2026-10-02 |
| CVE-2026-104448 | high | 8.1 | No | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the ajaxdeletepage handler, which permanently deletes a page on... | 2026-10-02 |
| CVE-2026-104446 | medium | 6.5 | No | YesWiki before 4.6.7 contains an authentication bypass in the contact mail AJAX handler that allows unauthenticated attackers to send email... | 2026-10-02 |
| CVE-2026-104440 | medium | 5.3 | No | YesWiki before 4.6.7 contains a blind server-side request forgery vulnerability that allows unauthenticated attackers to make arbitrary serv... | 2026-10-02 |
| CVE-2026-95374 | medium | 6.5 | No | Incorrect authorization in Network in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a craft... | 2026-10-02 |
| CVE-2026-95380 | high | 8.8 | No | Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentially execute... | 2026-10-02 |
| CVE-2026-95381 | high | 8.3 | No | Improper input validation in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer pro... | 2026-10-02 |
| CVE-2026-95382 | medium | 6.5 | No | Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process... | 2026-10-02 |
| CVE-2026-95384 | medium | 5.3 | No | Race condition in Transactions Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially leak sensitive info... | 2026-10-02 |