Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13781 | critical | 9.6 | No | Insufficient validation of untrusted input in Skia in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the... | 2026-10-25 |
| CVE-2026-13780 | critical | 9.6 | No | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised th... | 2026-10-25 |
| CVE-2026-13776 | critical | 9.8 | No | Type Confusion in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potenti... | 2026-10-25 |
| CVE-2026-13775 | critical | 9.8 | No | Use after free in GPU in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentia... | 2026-10-25 |
| CVE-2026-12411 | critical | 9.6 | No | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite a... | 2026-10-25 |
| CVE-2026-56291 | critical | 9.8 | Listed | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vuln... | 2026-10-25 |
| CVE-2026-49869 | critical | 10.0 | Listed | Kestra is an open-source, event-driven orchestration platform. Prior to 1.0.45 and 1.3.21, AuthenticationFilter in Kestra OSS uses request.g... | 2026-10-25 |
| CVE-2026-59822 | high | 8.2 | Listed | LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to 1.84.0, LiteLLM's MCP Streamable HTTP endpoin... | 2026-10-25 |
| CVE-2026-14363 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - C... | 2026-10-25 |
| CVE-2026-58521 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - C... | 2026-10-25 |
| CVE-2026-56372 | critical | 9.1 | No | ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of boun... | 2026-10-25 |
| CVE-2026-57827 | critical | 9.8 | No | Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to... | 2026-10-25 |
| CVE-2026-57216 | critical | 10.0 | No | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, AMQP 0-9-1, AMQP 1.0, and Stream Protocol authent... | 2026-10-25 |
| CVE-2026-57211 | critical | 10.0 | No | RabbitMQ is a messaging and streaming broker. Prior to 4.1.11 and 4.2.6 on Windows, the RabbitMQ management plugin static file handler rabbi... | 2026-10-25 |
| CVE-2026-14535 | critical | 9.8 | No | In Trail of Bits fickling versions up to and including 0.1.11, the UnsafeImportsML analysis pass unconditionally calls AnalysisContext.short... | 2026-10-25 |
| CVE-2026-57983 | critical | 10.0 | No | Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature over a network. | 2026-10-25 |
| CVE-2026-12481 | critical | 9.8 | No | A vulnerability in keras-team/keras version 3.14.0 allows for arbitrary code execution due to improper handling of deserialization in the `L... | 2026-10-25 |
| CVE-2026-89284 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |
| CVE-2026-111326 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |
| CVE-2026-109111 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-24 |