Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85532 | high | 7.5 | No | Apache WSS4J accepted attacker-controlled derived-key lengths and offsets without adequate bounds. This could permit cryptographically weak... | 2026-10-02 |
| CVE-2026-95275 | medium | 6.5 | No | Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy... | 2026-10-02 |
| CVE-2026-95326 | high | 8.4 | No | Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sy... | 2026-10-02 |
| CVE-2026-95314 | high | 8.1 | No | Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to... | 2026-10-02 |
| CVE-2026-95303 | medium | 6.5 | No | Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass sy... | 2026-10-02 |
| CVE-2026-95285 | high | 8.4 | No | Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the ren... | 2026-10-02 |
| CVE-2026-95278 | high | 8.4 | No | Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process... | 2026-10-02 |
| CVE-2026-93698 | critical | 9.9 | No | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. | 2026-10-02 |
| CVE-2026-93697 | critical | 9.0 | No | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. | 2026-10-02 |
| CVE-2026-71452 | not reported | — | No | - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows OS Command Injection. This issue affects EasyIO FS32: before 3.... | 2026-10-02 |
| CVE-2026-71449 | not reported | — | No | : Use of Hard-coded Cryptographic Key vulnerability in Johnson Controls EasyIO FS32 allows : Retrieve Embedded Sensitive Data. This issue a... | 2026-10-02 |
| CVE-2026-71451 | not reported | — | No | - OS Command Injection vulnerability in Johnson Controls EasyIO FS32 allows - Command Injection. This issue affects EasyIO FS32: before 3.0... | 2026-10-02 |
| CVE-2026-104861 | high | 7.5 | No | probe-image-size gets image dimensions without downloading the entire file. Prior to 7.4.0, lib/parse_sync/svg.js and lib/parse_stream/svg.j... | 2026-10-02 |
| CVE-2026-21140 | not reported | — | No | Improper access control in ManagedProvisioning prior to SMR Sep-2026 Release 1 allows local attackers to install arbitrary applications. | 2026-10-02 |
| CVE-2026-104480 | not reported | — | No | Discord libdave before 1.2.0 did not reject an MLS Welcome message when the resulting group roster contained an unrecognized participant. An... | 2026-10-02 |
| CVE-2026-51895 | medium | 6.5 | No | Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py). Depending on the exposed entry, a... | 2026-10-02 |
| CVE-2026-27873 | not reported | — | No | - Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FG allows - Pasword Spraying. This issue affects EasyIO FG: before... | 2026-10-02 |
| CVE-2026-27874 | not reported | — | No | : Use of Hard-coded Credentials vulnerability in Johnson Controls EasyIO FS32 allows : Exploitation of Default or Hard-coded Credentials. T... | 2026-10-02 |
| CVE-2026-104123 | high | 7.3 | No | A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. Affected by this vulnerability is an unknown functiona... | 2026-10-02 |
| CVE-2026-104053 | medium | 6.3 | No | A vulnerability was identified in itsourcecode Pet Shop Management System 1.0. The impacted element is an unknown function of the file admin... | 2026-10-02 |