Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105873 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons... | 2026-10-07 |
| CVE-2026-105871 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons... | 2026-10-07 |
| CVE-2026-104393 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ... | 2026-10-07 |
| CVE-2026-104391 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master qui... | 2026-10-07 |
| CVE-2026-104390 | medium | 4.3 | No | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-07 |
| CVE-2026-103075 | medium | 4.3 | No | Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Leve... | 2026-10-07 |
| CVE-2026-77121 | medium | 6.5 | No | A user account with permission to deploy artifacts to a hosted Maven repository could upload a POM file containing an oversized metadata fie... | 2026-10-07 |
| CVE-2026-102099 | high | 7.2 | No | Kiteworks Core before version 9.5.0 is vulnerable to Arbitrary File Write. An improper restriction of a user-supplied file path in a Kitewor... | 2026-10-07 |
| CVE-2026-102098 | high | 7.2 | No | Kiteworks Core before version 9.5.0 is vulnerable to SQL Injection. A stored SQL injection vulnerability in a Kiteworks administrative repor... | 2026-10-07 |
| CVE-2026-102096 | high | 7.2 | No | Kiteworks Core before version 9.5.0 is vulnerable to OS Command Injection that allows an authenticated administrator to upload a configurati... | 2026-10-07 |
| CVE-2026-102093 | high | 7.2 | No | Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assig... | 2026-10-07 |
| CVE-2026-102092 | high | 8.7 | No | Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store craft... | 2026-10-07 |
| CVE-2026-106254 | medium | 5.1 | No | Information leak in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker to obtain sensitive information vi... | 2026-10-07 |
| CVE-2026-102090 | medium | 4.3 | No | Kiteworks Core before version 9.5.1 is vulnerable to Content Injection. A URL parameter in the PDF viewer was insufficiently validated, allo... | 2026-10-07 |
| CVE-2026-49933 | high | 7.8 | No | In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitia... | 2026-10-07 |
| CVE-2026-106414 | critical | 9.6 | No | Improper input validation in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineerin... | 2026-10-07 |
| CVE-2026-106413 | medium | 4.2 | No | Race condition in Browser in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoo... | 2026-10-07 |
| CVE-2026-106255 | high | 8.8 | No | Race condition in V8 in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code inside the sand... | 2026-10-07 |
| CVE-2026-106256 | high | 8.8 | No | Information leak in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering... | 2026-10-07 |
| CVE-2026-106253 | medium | 4.3 | No | Incorrect authorization in Extensions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to obtain cross-origin data via a cr... | 2026-10-07 |