Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-42002 | high | 8.4 | No | A code injection vulnerability has been discovered in the Robot Operating System 2 (ROS 2) 'ros2topic' command-line tool, affecting all ROS... | 2026-09-30 |
| CVE-2026-95350 | critical | 9.6 | No | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t... | 2026-09-30 |
| CVE-2026-95359 | low | 3.4 | No | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the render... | 2026-09-30 |
| CVE-2026-102616 | high | 7.3 | No | A vulnerability was detected in risesoft-y9 WorkFlow-Engine up to 9.6.10. Impacted is the function getByIdAndYear of the file CustomHistoric... | 2026-09-30 |
| CVE-2026-95357 | critical | 9.6 | No | Out of bounds write in GPU in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary... | 2026-09-30 |
| CVE-2026-102303 | medium | 4.3 | No | Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data vi... | 2026-09-30 |
| CVE-2026-102307 | medium | 4.7 | No | Uninitialized resource in Dawn in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sa... | 2026-09-30 |
| CVE-2026-95349 | critical | 9.6 | No | Buffer overflow in WebGL in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary co... | 2026-09-30 |
| CVE-2026-94286 | high | 7.1 | No | An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clie... | 2026-09-30 |
| CVE-2026-94285 | medium | 5.1 | No | An out-of-bounds read in libX11's byte-oriented codeset parser in libX11 before 1.8.14 could be used by malicious X servers to crash attache... | 2026-09-30 |
| CVE-2026-94284 | medium | 5.5 | No | An out-of-bounds read vulnerability in libX11's XIM trigger-key registration parser in libX11 before 1.8.14 could be used by malicious X ser... | 2026-09-30 |
| CVE-2026-94283 | medium | 6.5 | No | An out-of-bounds read vulnerability in libX11's XIM (X Input Method) attribute parser in libX11 before 1.8.14 could be used by malicious X s... | 2026-09-30 |
| CVE-2026-94282 | medium | 5.6 | No | An out-of-bounds read in libXi's XI2 enter/leave/focus cookie conversion in libXi before 1.8.4 could be used by malicious X server to crash... | 2026-09-30 |
| CVE-2026-86530 | high | 7.2 | No | BUFFALO Wi-Fi products handle some web form input improperly to assemble command line strings internally. An administrative user may send a... | 2026-09-30 |
| CVE-2026-76738 | low | 2.7 | No | A buffer overflow vulnerability exists in the API endpoint of HPE Networking Instant On that could allow an authenticated attacker with admi... | 2026-09-30 |
| CVE-2026-103321 | not reported | — | No | MISP contains a stored cross-site script (XSS) vulnerability in the event graph preview feature. The event graph preview image field was ac... | 2026-09-30 |
| CVE-2026-100638 | high | 7.6 | No | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the setNotebookIcon endpoint that allows authenticated administrator... | 2026-09-30 |
| CVE-2026-100609 | medium | 6.8 | No | Flowise (npm packages `flowise` and `flowise-components`) through 3.1.4 looks up credentials by ID without filtering on the requesting user'... | 2026-09-30 |
| CVE-2026-100605 | high | 7.1 | No | Flowise through 3.1.4 contains missing route-level RBAC checks on chat message endpoints that allow low-privileged API keys to read and dele... | 2026-09-30 |
| CVE-2026-100601 | medium | 5.3 | No | ClawHub (openclaw/clawhub) application/backend contains a server-side request forgery vulnerability in the public profile preview's image fe... | 2026-09-30 |