Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-110880 | medium | 6.5 | No | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-19 |
| CVE-2026-110907 | high | 7.5 | No | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title]... | 2026-10-19 |
| CVE-2026-110363 | medium | 5.4 | No | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-19 |
| CVE-2026-110373 | high | 8.1 | No | Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Privilege Escalation.Thi... | 2026-10-19 |
| CVE-2026-110372 | critical | 9.8 | No | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit... | 2026-10-19 |
| CVE-2026-110453 | medium | 4.3 | No | Nix before 2.35.3, when unsandboxed on macOS or FreeBSD, incorrectly allows connections made by build users from daemon clients. | 2026-10-19 |
| CVE-2026-107436 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials allows Object Injection.This issue affec... | 2026-10-19 |
| CVE-2026-106708 | high | 8.8 | No | XXL-JOB 3.5.0-SNAPSHOT and earlier contains a Cross-Site Request Forgery (CSRF) vulnerability in the user management controller (JobUserCont... | 2026-10-19 |
| CVE-2026-106706 | medium | 5.4 | No | XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores t... | 2026-10-19 |
| CVE-2026-104584 | critical | 9.8 | No | reNgine up to v2.2.0 and current master branch (commit de4199222cca5618f1255930ce78987e47d43a99) is vulnerable to OS Command Injection via t... | 2026-10-19 |
| CVE-2026-84007 | medium | 6.5 | No | Out-of-bounds read in Remote Desktop Gateway Service allows an authorized attacker to disclose information over a network. | 2026-10-19 |
| CVE-2026-84009 | medium | 4.7 | No | Time-of-check time-of-use (toctou) race condition in Windows Projected File System allows an authorized attacker to perform tampering locall... | 2026-10-19 |
| CVE-2025-3778 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-19 |
| CVE-2026-110913 | high | 8.8 | No | Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-10-19 |
| CVE-2026-110914 | high | 8.8 | No | Memory corruption in Workers in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code inside... | 2026-10-19 |
| CVE-2026-110915 | high | 8.8 | No | Use after free in Compositing in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox... | 2026-10-19 |
| CVE-2026-110916 | critical | 9.6 | No | Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code... | 2026-10-19 |
| CVE-2026-84011 | medium | 5.5 | No | Incorrect authorization in Windows SMB Client allows an authorized attacker to bypass a security feature locally. | 2026-10-19 |
| CVE-2026-66786 | critical | 9.1 | No | A flaw was found in submariner. In cert-auth mode, the connection configuration is built using free-form strings from the Custom Resource De... | 2026-10-19 |
| CVE-2026-112305 | high | 8.8 | No | Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the task_runner role to override protecte... | 2026-10-19 |