Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95352 | medium | 5.4 | No | Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypas... | 2026-09-30 |
| CVE-2026-95353 | high | 8.8 | No | Use after free in Bindings in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox vi... | 2026-09-30 |
| CVE-2026-95354 | high | 8.3 | No | Use after free in Verifier in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to pot... | 2026-09-30 |
| CVE-2026-95355 | high | 8.3 | No | Incorrect authorization in Navigation in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker who had compromised the re... | 2026-09-30 |
| CVE-2026-95356 | critical | 9.6 | No | Use after free in WindowDialog in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to potentiall... | 2026-09-30 |
| CVE-2026-102308 | critical | 9.6 | No | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary... | 2026-09-30 |
| CVE-2026-102309 | critical | 9.6 | No | Use after free in FullScreen in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute arbitrary code outside the sandbox... | 2026-09-30 |
| CVE-2026-97259 | not reported | — | No | Authorization Bypass Through User-Controlled Key vulnerability in WP Hosting AS Pay with Vipps for WooCommerce allows Exploiting Incorrectly... | 2026-09-30 |
| CVE-2026-97347 | high | 7.2 | No | The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to,... | 2026-09-30 |
| CVE-2026-96649 | high | 7.2 | No | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-S... | 2026-09-30 |
| CVE-2026-96440 | not reported | — | No | Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flow... | 2026-09-30 |
| CVE-2026-97685 | not reported | — | No | An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while s... | 2026-09-30 |
| CVE-2026-92712 | medium | 6.4 | No | The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parame... | 2026-09-30 |
| CVE-2026-92371 | high | 7.0 | No | TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Record... | 2026-09-30 |
| CVE-2026-92370 | high | 8.8 | No | An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows a... | 2026-09-30 |
| CVE-2026-96326 | high | 7.2 | No | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich... | 2026-09-30 |
| CVE-2026-92369 | high | 7.3 | No | TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A loc... | 2026-09-30 |
| CVE-2026-92368 | high | 7.8 | No | TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing... | 2026-09-30 |
| CVE-2026-92103 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client h... | 2026-09-30 |
| CVE-2026-88037 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` sho... | 2026-09-30 |