Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104471 | high | 7.2 | No | YesWiki before 4.6.7 contains an unrestricted file upload vulnerability that allows authenticated admins to write remote files into the web-... | 2026-10-02 |
| CVE-2026-104463 | high | 7.0 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows unauthenticated attackers to trigger server requests b... | 2026-10-02 |
| CVE-2026-104459 | medium | 6.5 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability in WebfingerService that allows unauthenticated attackers to trigg... | 2026-10-02 |
| CVE-2026-104455 | medium | 5.3 | No | YesWiki before 4.6.7 contains an access control bypass vulnerability that allows unauthenticated attackers to read restricted page content v... | 2026-10-02 |
| CVE-2026-104451 | medium | 4.3 | No | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in RevisionsHandler that allows attackers to restore old page revis... | 2026-10-02 |
| CVE-2026-104447 | high | 7.1 | No | YesWiki before 4.6.7 contains a cross-site request forgery vulnerability in the autoupdate UpdateAction that allows attackers to delete inst... | 2026-10-02 |
| CVE-2026-104443 | high | 8.1 | No | YesWiki before 4.6.7 contains an empty-filter scope bypass in the triples delete API that allows any authenticated user to delete or forge a... | 2026-10-02 |
| CVE-2026-104439 | medium | 5.3 | No | YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm re... | 2026-10-02 |
| CVE-2026-102798 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_add... | 2026-10-02 |
| CVE-2026-102797 | medium | 6.4 | No | Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue... | 2026-10-02 |
| CVE-2026-103505 | medium | 6.5 | No | Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3... | 2026-10-02 |
| CVE-2026-81480 | high | 7.2 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged at... | 2026-10-02 |
| CVE-2026-81481 | high | 7.5 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('... | 2026-10-02 |
| CVE-2026-84414 | high | 7.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validatio... | 2026-10-02 |
| CVE-2026-84421 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation... | 2026-10-02 |
| CVE-2026-84422 | high | 7.2 | No | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing... | 2026-10-02 |
| CVE-2026-84436 | critical | 9.1 | No | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged auth... | 2026-10-02 |
| CVE-2026-95360 | medium | 5.3 | No | Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitiv... | 2026-10-02 |
| CVE-2026-95361 | medium | 4.3 | No | Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web or... | 2026-10-02 |
| CVE-2026-95363 | medium | 5.4 | No | UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof... | 2026-10-02 |