Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100543 | high | 7.5 | No | OpenClaw (npm package openclaw) before 2026.8.1 could include deterministic hashes computed over the original, unredacted configuration in r... | 2026-10-05 |
| CVE-2026-100539 | low | 2.6 | No | OpenClaw (npm package 'openclaw') before 2026.8.1 fails to revoke memory tool access when an operator hot-disables memory configuration. Exi... | 2026-10-05 |
| CVE-2026-100535 | high | 7.5 | No | OpenClaw (npm package 'openclaw') versions >= 2026.4.5 and < 2026.8.1 can lose the originating requester's restrictions and untrusted proven... | 2026-10-05 |
| CVE-2026-100527 | medium | 5.3 | No | OpenClaw before 2026.8.2 contains a denial of service vulnerability in the Browser extension relay that allows unauthenticated network sourc... | 2026-10-05 |
| CVE-2026-100523 | medium | 6.1 | No | Cotonti through 1.0.0 contains an open redirect vulnerability in message.php that base64-decodes the redirect parameter without domain valid... | 2026-10-05 |
| CVE-2026-100501 | medium | 6.5 | No | Flame through 2.4.0 contains an improper restriction of excessive authentication attempts vulnerability in the POST /api/auth login endpoint... | 2026-10-05 |
| CVE-2026-100391 | high | 8.2 | No | MediaFlow Proxy through 2.4.9 contains a server-side request forgery vulnerability in the /proxy routes due to missing and incomplete destin... | 2026-10-05 |
| CVE-2026-100780 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Th... | 2026-10-05 |
| CVE-2025-1020 | critical | 9.8 | No | Memory safety bugs present in Firefox 134 and Thunderbird 134. Some of these bugs showed evidence of memory corruption and we presume that w... | 2026-10-05 |
| CVE-2025-1017 | critical | 9.8 | No | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 128.6, and Thunderbird 128.6. Some of these bugs showed evidence of... | 2026-10-05 |
| CVE-2025-1016 | critical | 9.8 | No | Memory safety bugs present in Firefox 134, Thunderbird 134, Firefox ESR 115.19, Firefox ESR 128.6, Thunderbird 115.19, and Thunderbird 128.6... | 2026-10-05 |
| CVE-2025-1009 | critical | 9.8 | No | An attacker could have caused a use-after-free via crafted XSLT data, leading to a potentially exploitable crash. This vulnerability was fix... | 2026-10-05 |
| CVE-2026-103624 | high | 8.3 | No | Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker who had compromised the r... | 2026-10-05 |
| CVE-2026-103628 | critical | 9.6 | No | Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox... | 2026-10-05 |
| CVE-2026-103625 | high | 8.8 | No | Type confusion in V8 in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-10-05 |
| CVE-2026-103622 | high | 8.8 | No | Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code inside the sandbox via a c... | 2026-10-05 |
| CVE-2026-103626 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote attacker leveraging social engi... | 2026-10-05 |
| CVE-2026-103629 | medium | 4.3 | No | Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page... | 2026-10-05 |
| CVE-2026-103621 | medium | 4.3 | No | Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HT... | 2026-10-05 |
| CVE-2026-103004 | medium | 5.3 | No | Next.js versions from 16.3.0 to 16.3.7 warm `use cache` handlers using `next/root-params` and can leak their return value to pages with diff... | 2026-10-05 |