Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2021-22175 | critical | 9.8 | Listed | When requests to the internal network for webhooks are enabled, a server-side request forgery vulnerability in GitLab affecting all versions... | 2026-10-01 |
| CVE-2023-27351 | high | 7.5 | Listed | This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentic... | 2026-10-01 |
| CVE-2018-13374 | medium | 4.3 | Listed | A Improper Access Control in Fortinet FortiOS 6.0.2, 5.6.7 and before, FortiADC 6.1.0, 6.0.0 to 6.0.1, 5.4.0 to 5.4.4 allows attacker to obt... | 2026-10-01 |
| CVE-2017-6884 | high | 8.8 | Listed | A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is locate... | 2026-10-01 |
| CVE-2021-22054 | high | 7.5 | Listed | VMware Workspace ONE UEM console 20.0.8 prior to 20.0.8.37, 20.11.0 prior to 20.11.0.40, 21.2.0 prior to 21.2.0.27, and 21.5.0 prior to 21.5... | 2026-10-01 |
| CVE-2015-2291 | high | 7.8 | Listed | (1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to c... | 2026-10-01 |
| CVE-2025-21590 | medium | 4.4 | Listed | An Improper Isolation or Compartmentalization vulnerability in the kernel of Juniper Networks Junos OS allows a local attacker with high pri... | 2026-10-01 |
| CVE-2026-58185 | critical | 9.8 | No | The Apache Traffic Server intercept plugin has a use-after-free. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.11, from... | 2026-10-01 |
| CVE-2026-58179 | critical | 9.8 | No | The Apache Traffic Server regex_remap plugin overflows the stack and integers from substitution input. This issue affects Apache Traffic Se... | 2026-10-01 |
| CVE-2026-58163 | critical | 9.1 | No | Apache Traffic Server mishandles on-disk cache fields and object lifetimes, corrupting state or crashing. This issue affects Apache Traffic... | 2026-10-01 |
| CVE-2026-48710 | medium | 6.5 | Listed | Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being use... | 2026-10-01 |
| CVE-2026-17176 | not reported | — | No | An OS command injection vulnerability in the TDDP module of Deco BE11000 and Deco M9 Plus allows an adjacent network attacker to execute arb... | 2026-10-01 |
| CVE-2026-103754 | medium | 5.9 | No | A flaw was found in ansible-runner. The unstream_dir() function, which receives and extracts a streamed zip archive on the worker side of th... | 2026-10-01 |
| CVE-2026-95284 | critical | 9.6 | No | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t... | 2026-10-01 |
| CVE-2026-95295 | medium | 4.6 | No | Information leak in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via phys... | 2026-10-01 |
| CVE-2026-95330 | medium | 6.5 | No | Improper state validation in Downloads in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restriction... | 2026-10-01 |
| CVE-2026-95358 | medium | 4.4 | No | Incorrect authorization in Mobile in Google Chrome on on Android prior to 154.0.8037.57 allowed a local attacker to bypass system access res... | 2026-10-01 |
| CVE-2026-102299 | high | 8.8 | No | Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-10-01 |
| CVE-2026-102300 | medium | 4.3 | No | Uninitialized resource in WebGPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to obtain cross-origin data via a crafted... | 2026-10-01 |
| CVE-2026-102301 | high | 8.3 | No | Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to pot... | 2026-10-01 |