Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-61519 | high | 8.8 | No | Liberu CRM 0.9.1 before 10.0.0 contains a broken access control vulnerability that allows any user holding a pending team invitation to invi... | 2026-09-30 |
| CVE-2026-95281 | critical | 9.6 | No | Buffer overflow in ANGLE in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code outside t... | 2026-09-30 |
| CVE-2026-55107 | critical | 10.0 | No | Kobako is a Ruby gem that embeds a Wasm-isolated mruby interpreter inside applications, allowing execution of untrusted Ruby scripts (LLM-ge... | 2026-09-30 |
| CVE-2026-55094 | not reported | — | No | Taskcluster is the task execution framework that supports Mozilla's continuous integration and release processes. Prior to version 100.3.0,... | 2026-09-30 |
| CVE-2026-103475 | critical | 9.1 | No | yii2-starter-kit through 4.2.0 exposes the Yii debug and Gii modules to all IP addresses by setting allowedIPs to ['*'] in its default devel... | 2026-09-30 |
| CVE-2026-103471 | high | 7.5 | No | restbed through 5.0.0 buffers HTTP request headers without enforcing a maximum size limit, allowing remote unauthenticated attackers to exha... | 2026-09-30 |
| CVE-2026-103432 | high | 8.1 | No | apcupsd through 3.14.14 has an sscanf stack-based buffer overflow in getupsvar() in src/cgi/upsfetch.c (used by upsstats.cgi, multimon.cgi,... | 2026-09-30 |
| CVE-2026-103233 | medium | 6.3 | No | A security vulnerability has been detected in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Th... | 2026-09-30 |
| CVE-2026-103230 | high | 7.3 | No | A vulnerability was determined in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Impacted is th... | 2026-09-30 |
| CVE-2026-103395 | critical | 9.8 | No | LightLLM through 1.2.0 visual_only deployments expose an unauthenticated RPyC service with allow_pickle enabled that deserializes attacker-s... | 2026-09-30 |
| CVE-2026-103087 | not reported | — | No | Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to c... | 2026-09-30 |
| CVE-2026-102991 | medium | 6.5 | No | Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template... | 2026-09-30 |
| CVE-2026-102984 | not reported | — | No | Astro is a web framework for content-driven websites. Prior to 11.1.3, the @astrojs/node adapter builds a request URL from the Host header,... | 2026-09-30 |
| CVE-2026-102938 | not reported | — | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write() writes prompt values verbatim to... | 2026-09-30 |
| CVE-2026-102925 | high | 7.8 | No | virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.13, the generated activate (bash and zsh) and activate... | 2026-09-30 |
| CVE-2026-102877 | medium | 4.4 | No | Fider before 0.38.0 contains a server-side request forgery vulnerability due to a time-of-check time-of-use gap in URL validation for webhoo... | 2026-09-30 |
| CVE-2026-102829 | not reported | — | No | simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript... | 2026-09-30 |
| CVE-2026-102825 | low | 3.7 | No | Russh is a Rust SSH client and server library. Prior to 0.62.6, the USERAUTH_REQUEST path reached from server::run_stream in russh/src/serve... | 2026-09-30 |
| CVE-2026-102821 | medium | 6.5 | No | Russh is a Rust SSH client and server library. Prior to 0.63.2, an authenticated remote peer can send SSH_MSG_KEXINIT without the required S... | 2026-09-30 |
| CVE-2026-102717 | high | 7.5 | No | MQTT WebSocket setter ABI mismatch may disclose memory or cause a crash | 2026-09-30 |