Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88276 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows administrator-controlled WEP key values containing shell syntax to execute arbitrary commands as root. | 2026-09-10 |
| CVE-2026-88275 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled WPA-PSK containing shell syntax to execute arbitrary commands as root when wir... | 2026-09-10 |
| CVE-2026-88274 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled wireless SSID containing shell syntax to execute arbitrary commands as root. | 2026-09-10 |
| CVE-2026-88273 | high | 7.2 | No | GeoVision GV-LPC2211 V1.13 allows an administrator-controlled PPPoE username to escape a sourced shell configuration assignment and execute... | 2026-09-10 |
| CVE-2026-87649 | medium | 5.4 | No | UI misrepresentation in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass... | 2026-09-10 |
| CVE-2026-87640 | medium | 6.1 | No | Out of bounds read in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the render... | 2026-09-10 |
| CVE-2026-87570 | high | 8.8 | No | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer... | 2026-09-10 |
| CVE-2026-87569 | high | 8.8 | No | Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sys... | 2026-09-10 |
| CVE-2026-87557 | medium | 4.3 | No | Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the render... | 2026-09-10 |
| CVE-2026-87552 | medium | 5.5 | No | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensi... | 2026-09-10 |
| CVE-2026-87549 | medium | 6.5 | No | Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass sy... | 2026-09-10 |
| CVE-2026-87548 | medium | 4.3 | No | Improper state validation in Installer in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restriction... | 2026-09-10 |
| CVE-2026-87450 | high | 7.5 | No | Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to ob... | 2026-09-10 |
| CVE-2026-87433 | high | 8.8 | No | Race condition in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypa... | 2026-09-10 |
| CVE-2026-86734 | medium | 6.5 | No | Snipe-IT before 8.7.1 fails to validate the length of the note field in the POST /account/accept/{acceptance} endpoint, allowing authenticat... | 2026-09-10 |
| CVE-2026-86729 | high | 7.4 | No | WWBN AVideo through commit e01e41ecc (no patched version available) exposes get_api_preauthorize in plugin/API/API.php as a second, undocume... | 2026-09-10 |
| CVE-2026-86724 | medium | 6.5 | No | AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site request forgery vulnerability in plugin/YPTWallet/view/... | 2026-09-10 |
| CVE-2026-86719 | medium | 5.4 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 (master) contains a cross-site request forgery vulnerability in the Cust... | 2026-09-10 |
| CVE-2026-86600 | high | 8.2 | No | In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login reques... | 2026-09-10 |
| CVE-2026-86712 | high | 8.8 | No | SiYuan before 3.8.2 trusts the attacker-writable text/siyuan clipboard MIME type and skips sanitization in the paste handler, allowing code... | 2026-09-10 |