Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100798 | high | 8.1 | No | Cryptography misuse in Storage: Quota Manager component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153... | 2026-10-19 |
| CVE-2026-100799 | medium | 4.3 | No | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100800 | critical | 9.6 | No | Sandbox escape due to use-after-free in the Disability Access APIs component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird... | 2026-10-19 |
| CVE-2026-100802 | medium | 4.3 | No | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100803 | high | 8.1 | No | Same-origin policy bypass in the WebExtensions component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 14... | 2026-10-19 |
| CVE-2026-100804 | critical | 9.6 | No | Sandbox escape due to use-after-free in the Preferences: Backend component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100805 | high | 7.5 | No | Race condition, use-after-free in the Audio/Video component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100806 | medium | 4.3 | No | Uninitialized memory in the Graphics: WebGPU component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.... | 2026-10-19 |
| CVE-2026-100807 | high | 8.8 | No | Privilege escalation in the DOM: Service Workers component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird... | 2026-10-19 |
| CVE-2026-100788 | critical | 9.8 | No | Invalid pointer in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 14... | 2026-10-19 |
| CVE-2026-100789 | high | 8.8 | No | Use-after-free in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,... | 2026-10-19 |
| CVE-2026-96628 | medium | 4.3 | No | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-... | 2026-10-19 |
| CVE-2026-112307 | high | 7.3 | No | sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text con... | 2026-10-19 |
| CVE-2026-112306 | high | 7.2 | No | NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvali... | 2026-10-19 |
| CVE-2026-112270 | medium | 6.5 | No | SGLang through 0.5.22 with the Mooncake disaggregation backend contains an uncontrolled memory allocation vulnerability in handle_staging_rs... | 2026-10-19 |
| CVE-2026-112265 | medium | 6.5 | No | LangBot through 4.11.0 contains a missing authenticity verification vulnerability that allows unauthenticated attackers to inject forged Lar... | 2026-10-19 |
| CVE-2026-112143 | high | 7.3 | No | A security flaw has been discovered in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this... | 2026-10-19 |
| CVE-2026-112139 | high | 7.3 | No | A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects... | 2026-10-19 |
| CVE-2026-112106 | low | 3.7 | No | A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affecte... | 2026-10-19 |
| CVE-2026-112102 | medium | 6.3 | No | A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src... | 2026-10-19 |