Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93382 | high | 8.8 | No | Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-09-19 |
| CVE-2026-83318 | high | 7.5 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Administration). Supported versions that are affected are 8... | 2026-09-19 |
| CVE-2026-83315 | high | 8.8 | No | Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security). Supported versions that are affected... | 2026-09-19 |
| CVE-2026-11381 | high | 8.8 | No | IBM MQ could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to improper validation o... | 2026-09-19 |
| CVE-2026-15815 | high | 8.8 | No | Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain... | 2026-09-19 |
| CVE-2026-53266 | high | 8.8 | Listed | In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: make ebt_snat ARP rewrite writable The ebtables SNA... | 2026-09-19 |
| CVE-2026-10858 | critical | 9.9 | No | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially execute arbi... | 2026-09-19 |
| CVE-2026-10744 | high | 7.5 | No | IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or potentially escalate pri... | 2026-09-19 |
| CVE-2026-92944 | critical | 9.8 | No | vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wra... | 2026-09-19 |
| CVE-2026-92938 | critical | 9.9 | No | vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either... | 2026-09-19 |
| CVE-2026-92933 | medium | 5.8 | No | vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfil... | 2026-09-19 |
| CVE-2026-92917 | high | 7.5 | No | Grav is a flat-file CMS. In versions 2.0.0-rc.1 through 2.0.21, the Twig content sandbox fails to restrict the dump and serialize filters (p... | 2026-09-19 |
| CVE-2026-92860 | critical | 9.1 | No | A security flaw has been discovered in rcourtman Pulse up to 6.0.4/6.1.0-rc.4. Affected by this issue is the function fmt.Sprintf of the fil... | 2026-09-19 |
| CVE-2026-78528 | medium | 5.3 | No | Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. | 2026-09-19 |
| CVE-2026-74002 | medium | 5.3 | No | Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. | 2026-09-19 |
| CVE-2026-66630 | high | 7.6 | No | Administrator SQL Injection in PublishPress Series <= 3.1.3 versions. | 2026-09-19 |
| CVE-2026-66619 | high | 7.6 | No | Administrator SQL Injection in Newsletters <= 4.18 versions. | 2026-09-19 |
| CVE-2026-87796 | critical | 9.8 | No | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9... | 2026-09-19 |
| CVE-2026-66579 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.2.1 versions. | 2026-09-19 |
| CVE-2026-66574 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions. | 2026-09-19 |