Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103679 | medium | 6.5 | No | A flaw was found in tnef. A remote attacker could exploit this vulnerability by providing a specially crafted Transport Neutral Encapsulatio... | 2026-10-05 |
| CVE-2026-96869 | medium | 4.3 | No | Information disclosure in the Networking component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17,... | 2026-10-05 |
| CVE-2026-100782 | high | 8.8 | No | Privilege escalation due to incorrect boundary conditions in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thun... | 2026-10-05 |
| CVE-2026-100783 | medium | 4.3 | No | Uninitialized memory in the Audio/Video component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, T... | 2026-10-05 |
| CVE-2026-100784 | high | 8.8 | No | Use-after-free in the Layout: Text and Fonts component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.... | 2026-10-05 |
| CVE-2026-103680 | medium | 6.5 | No | A flaw was found in tnef. A heap-based buffer overflow can occur in the find_free_number() function when generating numbered backup suffixes... | 2026-10-05 |
| CVE-2026-73546 | high | 7.4 | No | Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's... | 2026-10-05 |
| CVE-2026-100785 | high | 8.8 | No | Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 140.17, Th... | 2026-10-05 |
| CVE-2026-100786 | critical | 9.6 | No | Sandbox escape due to use-after-free in the Graphics component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderb... | 2026-10-05 |
| CVE-2026-88779 | high | 7.5 | Listed | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS,... | 2026-10-05 |
| CVE-2026-100787 | critical | 9.6 | No | Sandbox escape in the XUL component. This vulnerability was fixed in Firefox ESR 153.4, Thunderbird 157, Thunderbird 153.4, and Firefox 157. | 2026-10-05 |
| CVE-2026-56154 | critical | 9.8 | No | Use After Free vulnerability in Apache HTTP Server's mod_rewrite when using lookahead (%{LA-U:HTTP:...}) This issue affects Apache HTTP Ser... | 2026-10-05 |
| CVE-2026-57941 | critical | 9.8 | No | Use After Free vulnerability in Apache HTTP Server's mod_http2 via shared session->bbtmp re-entrancy This issue affects Apache HTTP Server:... | 2026-10-05 |
| CVE-2026-58415 | medium | 5.3 | No | Internal state files accessible to external parties in mod_dav_fs in Apache Software Foundation Apache HTTP Server before 2.4.69 on all plat... | 2026-10-05 |
| CVE-2026-59685 | high | 7.5 | No | Out-of-bounds Write vulnerability in Apache HTTP Server on Windows while processing paths with 8.3 names that may grow when expanded. This... | 2026-10-05 |
| CVE-2026-5782 | medium | 5.2 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in MRV Technology Foreign Trade Ltd. Co.... | 2026-10-05 |
| CVE-2026-59797 | critical | 9.8 | No | Improper Privilege Management vulnerability in Apache HTTP Server's mod_ssl via SSLRequire and file-related expressions. This issue affects... | 2026-10-05 |
| CVE-2026-63045 | high | 7.5 | No | Improper validation of FTP PASV reply address in mod_proxy_ftp in Apache Software Foundation Apache HTTP Server through 2.4.68 on all platfo... | 2026-10-05 |
| CVE-2026-103488 | high | 7.1 | No | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed authenticated users to add themselves to project teams and access re... | 2026-10-05 |
| CVE-2026-103489 | medium | 5.4 | No | In JetBrains YouTrack before 2026.2.19422 hTML injection in VCS command failure notifications was possible | 2026-10-05 |