Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100845 | high | 7.8 | No | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow... | 2026-09-30 |
| CVE-2026-77762 | high | 8.1 | No | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacke... | 2026-09-30 |
| CVE-2026-76183 | critical | 9.8 | No | Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be byp... | 2026-09-30 |
| CVE-2026-73581 | medium | 6.5 | No | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs w... | 2026-09-30 |
| CVE-2026-103235 | not reported | — | No | MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation r... | 2026-09-30 |
| CVE-2026-103040 | critical | 9.8 | No | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling fl... | 2026-09-30 |
| CVE-2026-102771 | medium | 4.7 | No | A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templateP... | 2026-09-30 |
| CVE-2026-102335 | high | 7.1 | No | Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permi... | 2026-09-30 |
| CVE-2026-101087 | medium | 4.3 | No | Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the d... | 2026-09-30 |
| CVE-2026-100674 | medium | 4.3 | No | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden char... | 2026-09-30 |
| CVE-2026-100670 | high | 8.8 | No | Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by... | 2026-09-30 |
| CVE-2026-100666 | high | 7.3 | No | Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136... | 2026-09-30 |
| CVE-2026-100662 | high | 7.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.0.Final through 4.2.17.Final contain an uncontrolled resource consumption vul... | 2026-09-30 |
| CVE-2026-100646 | high | 8.1 | No | SiYuan is a self-hosted personal knowledge management system. In versions up to and including 3.8.3, the kernel's authentication guards (Che... | 2026-09-30 |
| CVE-2026-100642 | high | 7.6 | No | SiYuan versions from v2.1.0 before v3.8.4 contain a cross-site request forgery vulnerability in the CheckAuth lock-screen pass-through branc... | 2026-09-30 |
| CVE-2026-95279 | medium | 5.4 | No | UI misrepresentation in Omnibox in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a c... | 2026-09-30 |
| CVE-2026-95283 | critical | 9.6 | No | Buffer overflow in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary cod... | 2026-09-30 |
| CVE-2026-95302 | low | 2.9 | No | Incorrect authorization in WebAPKs in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to obtain cross-origin dat... | 2026-09-30 |
| CVE-2026-95329 | critical | 9.6 | No | Out of bounds write in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrar... | 2026-09-30 |
| CVE-2026-95332 | medium | 4.7 | No | Use of uninitialized variable in Tint in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to read memory outside... | 2026-09-30 |