Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95276 | high | 8.3 | No | Improper input validation in Themes in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce... | 2026-09-30 |
| CVE-2026-95277 | critical | 9.6 | No | Use after free in Views in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the... | 2026-09-30 |
| CVE-2026-100702 | medium | 5.9 | No | Nodemailer before 10.0.2 fails to properly flatten deeply nested arrays in recipient fields such as to, cc, and bcc, allowing attackers to c... | 2026-09-30 |
| CVE-2026-100701 | medium | 5.9 | No | Nodemailer versions 5.0.0 through 10.0.1 use a process-global DNS cache that is keyed only by the DNS host, while each cache entry also stor... | 2026-09-30 |
| CVE-2026-100700 | high | 7.5 | No | nodemailer before 10.0.6 contains a denial of service vulnerability in the addressparser free-text fallback regex pattern that exhibits quad... | 2026-09-30 |
| CVE-2026-100699 | medium | 5.3 | No | Nodemailer is a Node.js email-sending library. In versions >= 9.1.0 and < 10.0.9, the address parser (src/addressparser) mishandles addresse... | 2026-09-30 |
| CVE-2026-102306 | critical | 9.6 | No | Use after free in Bluetooth in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to potentially execute arbitrary code outside... | 2026-09-30 |
| CVE-2026-102570 | medium | 5.5 | No | ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_... | 2026-09-30 |
| CVE-2026-100372 | high | 7.2 | No | ClipBucket v5 before 5.5.3-#197 contains a path traversal vulnerability in the admin template editor that allows authenticated administrator... | 2026-09-30 |
| CVE-2026-95280 | high | 7.5 | No | Race condition in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-09-30 |
| CVE-2026-102459 | medium | 6.1 | No | EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrar... | 2026-09-30 |
| CVE-2026-102458 | critical | 9.8 | No | EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plai... | 2026-09-30 |
| CVE-2026-102457 | medium | 6.5 | No | EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability t... | 2026-09-30 |
| CVE-2026-102456 | medium | 6.5 | No | EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to r... | 2026-09-30 |
| CVE-2026-102455 | critical | 9.8 | No | EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code... | 2026-09-30 |
| CVE-2026-102454 | high | 7.2 | No | EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell... | 2026-09-30 |
| CVE-2026-95286 | high | 8.8 | No | Type confusion in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi... | 2026-09-30 |
| CVE-2026-95509 | not reported | — | No | Strings optimized for Latin-1 displaying Latin-1 characters cause incorrect String.arg() formatting by an incorrect buffer size calculation,... | 2026-09-30 |
| CVE-2026-95287 | medium | 5.4 | No | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce... | 2026-09-30 |
| CVE-2026-95288 | medium | 5.4 | No | UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafte... | 2026-09-30 |