Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84663 | medium | 5.4 | No | A cross-site request forgery (CSRF) vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 798.v5cc688825312 and earlier allows attacker... | 2026-09-03 |
| CVE-2026-84662 | medium | 4.3 | No | Jenkins LDAP Plugin 807.809.vd3a_4e5e4ec98 and earlier allows connecting to a specified URL through Stapler data binding, allowing attackers... | 2026-09-03 |
| CVE-2026-84661 | medium | 5.4 | No | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `... | 2026-09-03 |
| CVE-2026-84660 | medium | 5.4 | No | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the... | 2026-09-03 |
| CVE-2026-84654 | medium | 5.4 | No | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,... | 2026-09-03 |
| CVE-2026-84649 | high | 8.8 | No | In Stapler 1839.ved17667b_a_eb_5 through 2107.v8dfcb_e8ed317 (both inclusive), except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.447 th... | 2026-09-03 |
| CVE-2026-84647 | high | 8.8 | No | In Stapler 2107.v8dfcb_e8ed317 and earlier, except 2088.2093.vd7c3e58008a_6, included in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier,... | 2026-09-03 |
| CVE-2026-84323 | medium | 5.3 | No | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-84324 | critical | 9.0 | No | Use after free in Proxy in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code outside the sandbox via... | 2026-09-03 |
| CVE-2026-84325 | critical | 9.8 | No | Improper input validation in DataTransfer in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to... | 2026-09-03 |
| CVE-2026-84326 | high | 8.8 | No | Uninitialized resource in V8 in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to execute arbitrary code inside the sandbox... | 2026-09-03 |
| CVE-2026-84328 | low | 3.1 | No | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-84329 | medium | 5.3 | No | Confused deputy in CredentialProvider in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised th... | 2026-09-03 |
| CVE-2026-84331 | low | 3.1 | No | Incorrect authorization in Actor in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process... | 2026-09-03 |
| CVE-2026-84332 | medium | 6.5 | No | Incorrect authorization in SiteSettings in Google Chrome prior to 152.0.7977.75 allowed a remote attacker to bypass system access restrictio... | 2026-09-03 |
| CVE-2026-84334 | high | 8.1 | No | Incorrect authorization in Chromoting in Google Chrome on on Windows prior to 152.0.7977.75 allowed a local attacker to execute arbitrary co... | 2026-09-03 |
| CVE-2026-84335 | high | 8.3 | No | Incorrect authorization in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proce... | 2026-09-03 |
| CVE-2026-67394 | not reported | — | No | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions... | 2026-09-03 |
| CVE-2026-48932 | low | 3.7 | No | A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from... | 2026-09-03 |
| CVE-2026-78319 | not reported | — | No | A service running on the affected products contains a potential Time-of-Check Time-of-Use (TOCTOU) race condition. An unauthenticated remote... | 2026-09-03 |