Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-47826 | critical | 9.1 | No | The blobs.yml path key traversal vulnerability in the BOSH CLI tool allows an attacker to write arbitrary files and exfiltrate sensitive inf... | 2026-10-25 |
| CVE-2026-55471 | critical | 9.1 | No | HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.10, org.hl7.fhir.utili... | 2026-10-25 |
| CVE-2026-54527 | critical | 9.0 | No | JupyterLab Git is a Git extension for JupyterLab. From 0.30.0b3 before 0.54.0, the PlainTextDiff.ts createHeader() method passes Git filenam... | 2026-10-25 |
| CVE-2026-8649 | critical | 9.8 | No | Improper Neutralization of Special Elements in Data Query Logic vulnerability in Progress MOVEit Transfer (Custom Reports modules). This is... | 2026-10-25 |
| CVE-2026-9074 | critical | 9.8 | No | IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the passw... | 2026-10-25 |
| CVE-2026-58453 | critical | 9.8 | No | JAIOTlink C492A-W6 Wi-Fi IP cameras running firmware 4.8.30.57701411 contain a hard-coded credentials vulnerability that allows network-adja... | 2026-10-25 |
| CVE-2026-58025 | critical | 9.8 | No | Deserialization of untrusted data vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files incl... | 2026-10-25 |
| CVE-2026-14120 | critical | 9.6 | No | Inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer... | 2026-10-25 |
| CVE-2026-14109 | critical | 9.6 | No | Insufficient policy enforcement in Mojo in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer p... | 2026-10-25 |
| CVE-2026-14106 | critical | 9.6 | No | Insufficient validation of untrusted input in Text in Google Chrome on Android prior to 150.0.7871.47 allowed a remote attacker who had comp... | 2026-10-25 |
| CVE-2026-14104 | critical | 9.8 | No | Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to execute ar... | 2026-10-25 |
| CVE-2026-14101 | critical | 9.6 | No | Insufficient policy enforcement in Sandbox in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who had compromised the... | 2026-10-25 |
| CVE-2026-13785 | critical | 9.6 | No | Use after free in Bluetooth in Google Chrome on Mac prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in speci... | 2026-10-25 |
| CVE-2026-13782 | critical | 10.0 | No | Use after free in Browser in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to pote... | 2026-10-25 |
| CVE-2026-13781 | critical | 9.6 | No | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the... | 2026-10-25 |
| CVE-2026-13780 | critical | 9.6 | No | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th... | 2026-10-25 |
| CVE-2026-13776 | critical | 9.8 | No | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti... | 2026-10-25 |
| CVE-2026-13775 | critical | 9.8 | No | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia... | 2026-10-25 |
| CVE-2026-12411 | critical | 9.6 | No | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite a... | 2026-10-25 |
| CVE-2026-56291 | critical | 9.8 | Listed | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vuln... | 2026-10-25 |