Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95309 | medium | 5.4 | No | UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafte... | 2026-09-30 |
| CVE-2026-95307 | medium | 5.4 | No | UI misrepresentation in ExtensionsMenu in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to sp... | 2026-09-30 |
| CVE-2026-95306 | high | 8.8 | No | Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-09-30 |
| CVE-2026-94029 | medium | 6.5 | No | Server-side memory exhaustion in Apache MINA SSHD 1.0.0 to 2.19.0 and 3.0.0-M1 to 3.0.0-M5, component sshd-sftp, in the SFTP v6 check-file-n... | 2026-09-30 |
| CVE-2026-92870 | high | 7.5 | No | A stack-based buffer overflow vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to cause abnormal process termi... | 2026-09-30 |
| CVE-2026-92869 | medium | 6.5 | No | An out-of-bounds write vulnerability exists in Pgpool-II, which may allow an authenticated attacker to cause abnormal process termination. | 2026-09-30 |
| CVE-2026-92868 | medium | 6.5 | No | An improper certificate validation vulnerability exists in Pgpool-II, which may allow an unauthenticated attacker to bypass client certifica... | 2026-09-30 |
| CVE-2026-91096 | high | 7.5 | No | In proxygen from v2024.10.28.00 until v2026.09.28.00, WebTransportImpl::terminateSessionStreams (WebTransportImpl::destroy in releases befor... | 2026-09-30 |
| CVE-2026-91095 | medium | 5.3 | No | In proxygen from v2024.10.28.00 until v2026.09.28.00, the HTTPTransaction::onWebTransportUniStream and HTTPTransaction::onWebTransportBidiSt... | 2026-09-30 |
| CVE-2026-90783 | high | 7.8 | No | MKVToolNix through 101.0 contains a heap buffer overflow in the bundled avilib library's ODML superindex parser due to integer wraparound in... | 2026-09-30 |
| CVE-2026-88816 | high | 7.5 | No | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName. fetchrow_hashref uses the string pointe... | 2026-09-30 |
| CVE-2026-88815 | medium | 6.2 | No | DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv. When casting to SQL_NUMERIC, sql_type... | 2026-09-30 |
| CVE-2026-62308 | critical | 9.1 | No | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.6, Tugtainer allows an authenticated user... | 2026-09-30 |
| CVE-2026-74225 | high | 7.1 | No | U-Boot before 2026.10-rc5 contains out-of-bounds memory access in dhcp6_parse_options() that fails to validate SERVERID and CLIENTID option... | 2026-09-30 |
| CVE-2026-71974 | medium | 4.8 | No | U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to validate image size agains... | 2026-09-30 |
| CVE-2026-67993 | high | 8.8 | No | basecamp/upright at commit efe4f2e5254ac6e57e45d2261804cca74dbbca3f contains a login cross-site request forgery issue in the static credenti... | 2026-09-30 |
| CVE-2026-85644 | high | 7.5 | No | XS::Parse::Infix versions from 0.40 through 0.49 for Perl treat a number as an array reference. The wrapper function XS::Parse::Infix gener... | 2026-09-30 |
| CVE-2026-55181 | critical | 9.4 | No | Tugtainer is a self-hosted app for automating updates of Docker containers. Prior to version 1.30.3, Tugtainer's OIDC authentication can sti... | 2026-09-30 |
| CVE-2026-55177 | not reported | — | No | CloudTAK is a browser-based Common Operating Picture and situational awareness tool compatible with TAK. Prior to version 13.10.0, every rou... | 2026-09-30 |
| CVE-2026-55174 | medium | 5.9 | No | UltrafastSecp256k1 is a high-performance, multi-backend secp256k1 engine with reproducible audit evidence, compatibility shims, and profile-... | 2026-09-30 |