Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-121107 | high | 8.8 | No | Incorrect authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via... | 2026-11-04 |
| CVE-2026-121102 | high | 8.8 | No | Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a... | 2026-11-04 |
| CVE-2026-121088 | medium | 6.5 | No | Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a... | 2026-11-04 |
| CVE-2026-121087 | high | 8.8 | No | Improper input validation in Mobile in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a craf... | 2026-11-04 |
| CVE-2026-121072 | medium | 6.5 | No | Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted H... | 2026-11-04 |
| CVE-2026-121067 | medium | 5.4 | No | UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to... | 2026-11-04 |
| CVE-2026-121065 | high | 8.8 | No | Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypas... | 2026-11-04 |
| CVE-2026-121054 | high | 8.8 | No | Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted... | 2026-11-04 |
| CVE-2026-121053 | medium | 5.4 | No | UI misrepresentation in Transactions Platform in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker leveraging soc... | 2026-11-04 |
| CVE-2026-121050 | high | 8.8 | No | Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a craft... | 2026-11-04 |
| CVE-2026-121045 | medium | 5.4 | No | UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to... | 2026-11-04 |
| CVE-2026-11724 | high | 8.5 | No | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 th... | 2026-11-04 |
| CVE-2026-11376 | high | 8.8 | No | IBM MQ 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 th... | 2026-11-04 |
| CVE-2026-119749 | high | 7.5 | No | The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows unauthenticated attackers to... | 2026-11-04 |
| CVE-2026-119748 | medium | 6.5 | No | The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows unauthenticated attackers to acces... | 2026-11-04 |
| CVE-2026-120554 | high | 8.8 | No | The Import and export users and customers plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 2... | 2026-11-04 |
| CVE-2026-121043 | medium | 5.4 | No | UI misrepresentation in Payments in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI... | 2026-11-04 |
| CVE-2026-119747 | high | 7.1 | No | The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the check_post_permissions() method i... | 2026-11-04 |
| CVE-2026-118684 | medium | 5.9 | No | MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns True when hash_val is... | 2026-11-04 |
| CVE-2026-118679 | high | 7.5 | No | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger webhook that allows unauth... | 2026-11-04 |