Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-10758 | high | 7.5 | No | Esri LERC is an open-source image or raster format which supports rapid encoding and decoding for any pixel type. A Heap based Out-of-Bounds... | 2026-09-30 |
| CVE-2026-95294 | medium | 5.4 | No | UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI... | 2026-09-30 |
| CVE-2026-95296 | medium | 4.3 | No | Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to o... | 2026-09-30 |
| CVE-2026-95298 | high | 7.8 | No | Use after free in Browser in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the... | 2026-09-30 |
| CVE-2026-95299 | critical | 9.6 | No | Use after free in GPU in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside the sandbox via a... | 2026-09-30 |
| CVE-2026-95304 | high | 8.8 | No | Out of bounds write in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-09-30 |
| CVE-2026-95305 | medium | 4.8 | No | UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof... | 2026-09-30 |
| CVE-2026-102983 | not reported | — | No | Astro is a web framework for content-driven websites. From 5.2.0 until 8.2.4, the @astrojs/netlify adapter generates regular expressions for... | 2026-09-30 |
| CVE-2026-10739 | not reported | — | No | Cato Networks SDP Client for Windows before 6.12.6 allows a local user to delete arbitrary files with SYSTEM privileges via improper validat... | 2026-09-30 |
| CVE-2026-10726 | not reported | — | No | Cato Windows SDP Client before version 6.12.6 contains an arbitrary file disclosure vulnerability. A low-privileged local user can cause the... | 2026-09-30 |
| CVE-2026-102930 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed w... | 2026-09-30 |
| CVE-2026-97711 | not reported | — | No | Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.... | 2026-09-30 |
| CVE-2026-102601 | low | 3.5 | No | Flysystem is an open source file storage library for PHP. Prior to 3.35.3, the default WhitespacePathNormalizer in src/WhitespacePathNormali... | 2026-09-30 |
| CVE-2026-102600 | high | 7.5 | No | Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 0.1.1, @socket.io/cluster-engine uses inherited o... | 2026-09-30 |
| CVE-2026-102598 | not reported | — | No | Werkzeug is a comprehensive WSGI web application library. Prior to 3.1.9, the safe_join function used by send_from_directory can allow a NUL... | 2026-09-30 |
| CVE-2026-102360 | high | 8.6 | No | A missing bounds check in the binary decoder in lib0, versions 0.2.1-0.2.117 and earlier and 1.0.0-rc.32 and earlier, lets any unauthenticat... | 2026-09-30 |
| CVE-2026-19547 | not reported | — | No | Ghostscript for Windows is vulnerable to local privilege escalation through PostScript resource file hijacking. Due to the application searc... | 2026-09-30 |
| CVE-2026-15390 | not reported | — | No | Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after delivering a complete datagram. An attacker who can de... | 2026-09-30 |
| CVE-2026-102279 | low | 3.1 | No | Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APP_DEBUG=true pass attacker-contro... | 2026-09-30 |
| CVE-2026-101908 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.7.0 until 1.20.0, the fetch adapter constructs a Request with sanit... | 2026-09-30 |