Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100792 | high | 7.1 | No | JIT miscompilation in the JavaScript: WebAssembly component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird... | 2026-10-19 |
| CVE-2026-100793 | medium | 6.5 | No | JIT miscompilation in the JavaScript Engine component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100794 | critical | 9.6 | No | Sandbox escape due to incorrect boundary conditions in the Internationalization component. This vulnerability was fixed in Firefox ESR 153.4... | 2026-10-19 |
| CVE-2026-100795 | medium | 6.5 | No | Denial-of-service in the Networking component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100796 | high | 8.8 | No | Use-after-free in the JavaScript: WebAssembly component. This vulnerability was fixed in Thunderbird 157 and Firefox 157. | 2026-10-19 |
| CVE-2026-100797 | high | 8.8 | No | Privilege escalation due to use-after-free in the Graphics: WebRender component. This vulnerability was fixed in Firefox ESR 153.4, Thunderb... | 2026-10-19 |
| CVE-2026-98654 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-19 |
| CVE-2026-96627 | high | 8.8 | No | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/use... | 2026-10-19 |
| CVE-2026-89098 | medium | 5.5 | No | A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program asserti... | 2026-10-19 |
| CVE-2026-98165 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-19 |
| CVE-2026-90052 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-19 |
| CVE-2026-90050 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. | 2026-10-19 |
| CVE-2026-85977 | medium | 5.3 | No | A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a clien... | 2026-10-19 |
| CVE-2026-112266 | medium | 5.9 | No | SGLang through 0.5.22 contains a denial of service vulnerability that allows API clients to abort other users' in-flight generation requests... | 2026-10-19 |
| CVE-2026-112222 | medium | 5.4 | No | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This... | 2026-10-19 |
| CVE-2026-112144 | medium | 5.3 | No | A weakness has been identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. This affects an unkno... | 2026-10-19 |
| CVE-2026-111911 | critical | 9.8 | No | phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any... | 2026-10-19 |
| CVE-2026-111831 | medium | 5.3 | No | Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-19 |
| CVE-2026-111906 | medium | 6.5 | No | phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the Elasticsearch and OpenSea... | 2026-10-19 |
| CVE-2026-111901 | high | 7.5 | No | phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the unauthenticated faqs and search AP... | 2026-10-19 |