Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102313 | medium | 4.7 | No | Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 154.0.8037.92 allowed a remote attacker to read memory outside the s... | 2026-09-30 |
| CVE-2026-102314 | medium | 5.4 | No | UI misrepresentation in TabStrip in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to spoof UI elements via a crafted HTML p... | 2026-09-30 |
| CVE-2026-102316 | critical | 9.6 | No | Use after free in Views in Google Chrome prior to 154.0.8037.92 allowed a remote attacker leveraging social engineering to execute arbitrary... | 2026-09-30 |
| CVE-2026-102318 | medium | 4.7 | No | Out of bounds read in WebGL in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to read memory outside the sandbox via a craft... | 2026-09-30 |
| CVE-2026-19492 | low | 3.2 | No | IBM PowerVM Hypervisor FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerabil... | 2026-09-30 |
| CVE-2026-100840 | high | 7.8 | No | MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration engine that resolves _target_ values to arbit... | 2026-09-30 |
| CVE-2026-100844 | high | 7.8 | No | MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.apps.nnunet.nnunetv2_runner). User-controlle... | 2026-09-30 |
| CVE-2026-93306 | high | 7.1 | No | IBM Server Firmware FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, FW1060.00 through FW1060.81, and FW950.00 through FW950.H3 is... | 2026-09-30 |
| CVE-2026-100845 | high | 7.8 | No | MONAI before 1.6.0 contains an unsafe deserialization vulnerability in the NumpyReader class that unconditionally uses numpy.load with allow... | 2026-09-30 |
| CVE-2026-77762 | high | 8.1 | No | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Apache Tomcat allows an attacke... | 2026-09-30 |
| CVE-2026-76183 | critical | 9.8 | No | Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be byp... | 2026-09-30 |
| CVE-2026-73581 | medium | 6.5 | No | Improper Check for Certificate Revocation vulnerability in Apache Tomcat. Both the OpenSSL and OpenSSL-FFM TLS implementations ignore CRLs w... | 2026-09-30 |
| CVE-2026-103235 | not reported | — | No | MISP contains a mass assignment vulnerability in the event delegation feature. When a user with delegation permission submits a delegation r... | 2026-09-30 |
| CVE-2026-103040 | critical | 9.8 | No | LightLLM through 1.2.0 contains a remote code execution vulnerability in the router profiler service when started with --enable_profiling fl... | 2026-09-30 |
| CVE-2026-102771 | medium | 4.7 | No | A security vulnerability has been detected in Naichen ThinkCMF up to 8.0.7. Affected by this issue is the function MailController::templateP... | 2026-09-30 |
| CVE-2026-102335 | high | 7.1 | No | Nginx Proxy Manager through 2.16.0 fails to restrict the advanced_config field to administrators, allowing non-admin users with manage permi... | 2026-09-30 |
| CVE-2026-101087 | medium | 4.3 | No | Nezha versions 2.0.10 through 2.3.2 use a restricted HTTP client to validate user-configurable notification and DDNS webhook URLs, but the d... | 2026-09-30 |
| CVE-2026-100674 | medium | 4.3 | No | stoatchat before 0.15.5 fails to revalidate usernames after Unicode sanitization, allowing attackers to create usernames with forbidden char... | 2026-09-30 |
| CVE-2026-100670 | high | 8.8 | No | Grav CMS 2.0.14 through 2.0.24 contains a privilege escalation vulnerability in the group and account blueprints. The access map is gated by... | 2026-09-30 |
| CVE-2026-100666 | high | 7.3 | No | Netty's HttpServerCodec (io.netty:netty-codec-http) in versions 4.2.0.Final through 4.2.16.Final and in versions up to and including 4.1.136... | 2026-09-30 |