Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104439 | medium | 5.3 | No | YesWiki before 4.6.7 contains a user enumeration vulnerability in LostPasswordAction.php that allows unauthenticated attackers to confirm re... | 2026-10-02 |
| CVE-2026-102798 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group ThemeREX Addons trx_add... | 2026-10-02 |
| CVE-2026-102797 | medium | 6.4 | No | Server-Side Request Forgery (SSRF) vulnerability in ThemeREX Group ThemeREX Addons trx_addons allows Server Side Request Forgery.This issue... | 2026-10-02 |
| CVE-2026-103505 | medium | 6.5 | No | Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-driver) v3.1.0 through v3... | 2026-10-02 |
| CVE-2026-81480 | high | 7.2 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Stack-based Buffer Overflow vulnerability. A high privileged at... | 2026-10-02 |
| CVE-2026-81481 | high | 7.5 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('... | 2026-10-02 |
| CVE-2026-84414 | high | 7.8 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to change the ownership of arbitrary files due to improper validatio... | 2026-10-02 |
| CVE-2026-84421 | high | 8.8 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 could allow a remote authenticated attacker to execute arbitrary code due to improper validation... | 2026-10-02 |
| CVE-2026-84422 | high | 7.2 | No | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the CLI certificate SMIME recipient deletion functionality, allowing... | 2026-10-02 |
| CVE-2026-84436 | critical | 9.1 | No | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the certificate export CLI functionality, allowing a privileged auth... | 2026-10-02 |
| CVE-2026-95360 | medium | 5.3 | No | Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitiv... | 2026-10-02 |
| CVE-2026-95361 | medium | 4.3 | No | Confused deputy in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass web or... | 2026-10-02 |
| CVE-2026-95363 | medium | 5.4 | No | UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof... | 2026-10-02 |
| CVE-2026-95372 | high | 8.3 | No | Use after free in Chromecast in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to p... | 2026-10-02 |
| CVE-2026-95373 | high | 8.8 | No | Use after free in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to execute arbitr... | 2026-10-02 |
| CVE-2026-94405 | medium | 5.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in Shahjada Download Manager allows Retrieve Embedded Sensitive Data. This i... | 2026-10-02 |
| CVE-2026-86035 | high | 8.5 | No | Weblate is a web-based continuous localization platform used to manage software translations. Weblate 4.11.1 through 2026.7.1 contains an ar... | 2026-10-02 |
| CVE-2026-76875 | medium | 5.3 | No | PyPy before versions 3.11.16 and 3.12.14 contains a use-after-free vulnerability in the pyexpat module's ExternalEntityParserCreate function... | 2026-10-02 |
| CVE-2026-74222 | high | 8.2 | No | U-Boot before 2026.10-rc5 contains a use-after-free vulnerability in the httpc_recv_cb() function within the lwIP wget implementation. When... | 2026-10-02 |
| CVE-2026-71973 | medium | 5.2 | No | U-Boot before 2026.10-rc4 contains an integer overflow vulnerability in sqfs_read_directory_table() function when allocating the directory t... | 2026-10-02 |