Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101153 | high | 8.0 | No | On affected versions of CloudVision Portal (on-premises) or CloudVision Sensor, a path traversal vulnerability exists. An authenticated user... | 2026-10-07 |
| CVE-2026-101152 | high | 8.0 | No | Insufficient validation in the Single Sign-On (SSO) login flow could allow a remote, unauthenticated attacker to craft a URL that, when clic... | 2026-10-07 |
| CVE-2026-101151 | medium | 4.3 | No | Insufficient validation of request in login flow could allow a remote, unauthenticated attacker to craft a URL that, when clicked by a user,... | 2026-10-07 |
| CVE-2026-101150 | medium | 4.1 | No | Insufficient validation of OIDC bearer token configuration could allow a user with specific high privileges to direct requests to arbitrary... | 2026-10-07 |
| CVE-2026-101149 | medium | 4.1 | No | Insufficient validation of OIDC SSO provider configuration could allow a user with specific high privileges to direct requests to arbitrary... | 2026-10-07 |
| CVE-2026-106426 | high | 8.3 | No | Race condition in Fonts in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the... | 2026-10-07 |
| CVE-2026-106338 | medium | 5.4 | No | UI misrepresentation in PictureInPicture in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address ba... | 2026-10-07 |
| CVE-2026-106321 | medium | 4.3 | No | Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitiv... | 2026-10-07 |
| CVE-2026-106320 | medium | 4.2 | No | Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to... | 2026-10-07 |
| CVE-2026-106329 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to pot... | 2026-10-07 |
| CVE-2026-106325 | medium | 4.3 | No | Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to le... | 2026-10-07 |
| CVE-2026-105111 | medium | 4.7 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happen... | 2026-10-07 |
| CVE-2026-102101 | high | 8.1 | No | Kiteworks Core before version 9.5.0 is vulnerable to Deserialization of Untrusted Data. A deserialization weakness in Kiteworks Core could,... | 2026-10-07 |
| CVE-2026-97294 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant... | 2026-10-07 |
| CVE-2026-42721 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SERVIT Software Solutions affiliate-to... | 2026-10-07 |
| CVE-2026-42720 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Sarah Giles Dynamic User Directory dyn... | 2026-10-07 |
| CVE-2026-27434 | medium | 5.3 | No | Missing Authorization vulnerability in sc Internet Vivoo WP Rentals wprentals allows Exploiting Incorrectly Configured Access Control Securi... | 2026-10-07 |
| CVE-2026-105884 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-... | 2026-10-07 |
| CVE-2026-105876 | medium | 5.3 | No | Missing Authorization vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Retrieve Embedded Sensitive Data.This i... | 2026-10-07 |
| CVE-2026-105875 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Ele... | 2026-10-07 |