Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-101904 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.0.0 until 1.20.0, the dispatchRequest function normalizes inherited... | 2026-09-30 |
| CVE-2026-101903 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.16.1 until 1.20.0, the RFC 2397 regular expression allows slash cha... | 2026-09-30 |
| CVE-2026-101902 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 0.27.2 until 0.34.0 and 1.20.0, Axios default-instance requests that... | 2026-09-30 |
| CVE-2026-101900 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.12.0 until 1.20.0, ResolveConfig reads inherited Symbol.toStringTag... | 2026-09-30 |
| CVE-2026-101898 | not reported | — | No | Axios is a promise-based HTTP client for the browser and Node.js. From 1.13.0 until 1.20.0, Axios HTTP/2 request setup does not consistently... | 2026-09-30 |
| CVE-2026-101894 | critical | 9.1 | No | The decompress package for Node.js extracts archives. Prior to 10.2.2 and 11.1.4, the default decompress(input, output) API relies on lexica... | 2026-09-30 |
| CVE-2026-97222 | medium | 5.5 | No | A heap use-after-free flaw was found in Gnumeric. When a user opens a crafted Gnumeric workbook containing a malformed SheetObjectComponent... | 2026-09-30 |
| CVE-2026-71540 | high | 7.5 | No | Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. From 3.9.0 until 4.14... | 2026-09-30 |
| CVE-2026-77420 | medium | 5.5 | No | JLine is a Java library for handling console input. From 3.0.0 until 3.30.15 and 4.3.1, DefaultHistory.matchPatterns(String patterns, String... | 2026-09-30 |
| CVE-2026-61695 | high | 7.5 | No | Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoRe... | 2026-09-30 |
| CVE-2026-55866 | low | 3.7 | No | SpiceDB is an open source database system for creating and managing security-critical application permissions. From 1.34.0 until 1.54.0, Spi... | 2026-09-30 |
| CVE-2026-54156 | high | 7.5 | No | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the process-global g_alreadyUsedNonce cache used by non... | 2026-09-30 |
| CVE-2026-54155 | high | 7.7 | No | node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to 2.166.0, the UserNameIdentityToken authentication handler in pac... | 2026-09-30 |
| CVE-2026-53496 | medium | 5.3 | No | ExifReader is a JavaScript Exif information parser. Prior to 4.40.1, ExifReader.load() and the asynchronous file and URL loaders can pass at... | 2026-09-30 |
| CVE-2026-54529 | medium | 5.3 | No | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to 0.27.1, ModelView.sort_query in sqladmin/models.py accepts the attack... | 2026-09-30 |
| CVE-2026-102320 | medium | 6.5 | No | Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to... | 2026-09-30 |
| CVE-2026-102329 | medium | 6.1 | No | Cross-site scripting in WebUI in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to bypass web origin policy into a privilege... | 2026-09-30 |
| CVE-2026-102330 | medium | 6.5 | No | Incorrect authorization in SiteIsolation in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer... | 2026-09-30 |
| CVE-2026-103470 | not reported | — | No | In Internet2 Grouper before 7.5.1 (in some configurations), a user who is allowed to create or edit rules in the User Interface can escalate... | 2026-09-30 |
| CVE-2026-103056 | critical | 9.0 | No | AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStrike Real Time Respon... | 2026-09-30 |