Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95287 | medium | 5.4 | No | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce... | 2026-09-30 |
| CVE-2026-95288 | medium | 5.4 | No | UI misrepresentation in Mobile in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafte... | 2026-09-30 |
| CVE-2026-95289 | medium | 4.3 | No | Incorrect authorization in Scroll in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain... | 2026-09-30 |
| CVE-2026-95282 | high | 8.8 | No | Use after free in Platform in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi... | 2026-09-30 |
| CVE-2026-95291 | medium | 5.4 | No | UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar... | 2026-09-30 |
| CVE-2026-95292 | medium | 4.8 | No | Incorrect authorization in Safebrowsing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictio... | 2026-09-30 |
| CVE-2026-95312 | low | 3.1 | No | Information leak in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to... | 2026-09-30 |
| CVE-2026-95313 | critical | 9.6 | No | Use after free in Fullscreen in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside... | 2026-09-30 |
| CVE-2026-95315 | high | 7.8 | No | Use after free in Aura in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially execute arbitrary code outside the sa... | 2026-09-30 |
| CVE-2026-95316 | low | 2.9 | No | Unchecked return value in Performance in Google Chrome prior to 154.0.8037.57 allowed a local attacker to potentially read memory via a loca... | 2026-09-30 |
| CVE-2026-95317 | low | 3.1 | No | Incorrect authorization in MediaCapture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to o... | 2026-09-30 |
| CVE-2026-86556 | medium | 5.3 | No | There is an information disclosure vulnerability in ZTE U30 Air. Due to improper permission control, attackers can exploit the vulnerability... | 2026-09-30 |
| CVE-2026-95318 | critical | 9.6 | No | Buffer overflow in Video in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code outside the... | 2026-09-30 |
| CVE-2026-95319 | high | 8.3 | No | Use after free in Printing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot... | 2026-09-30 |
| CVE-2026-95320 | medium | 5.4 | No | Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce... | 2026-09-30 |
| CVE-2026-95323 | medium | 5.4 | No | UI misrepresentation in Chromium in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering t... | 2026-09-30 |
| CVE-2026-96886 | medium | 5.3 | No | The Course Booking System WordPress plugin before 7.0.9 does not restrict access to its booking export, allowing unauthenticated users to do... | 2026-09-30 |
| CVE-2026-94297 | low | 2.7 | No | The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management ca... | 2026-09-30 |
| CVE-2026-94274 | medium | 5.3 | No | The YayReviews WordPress plugin before 1.4.1 does not restrict access to an API route that returns individual customer review records, inclu... | 2026-09-30 |
| CVE-2026-93580 | medium | 5.3 | No | The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-se... | 2026-09-30 |