CVE-2026-90914 medium Joomla! Core - [20260904] - Core - XSS in the generic media output layouts in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-90913 medium Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3 since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-90907 medium Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3 since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102674 medium electron: Electron: Sandbox bypass via popup window creation since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102673 medium electron: Electron: Sandbox bypass via popups opened from sandboxed iframes since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102635 medium ImageMagick: ImageMagick: Information disclosure via crafted GIF file since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102633 medium expat: expat: Denial of Service via integer overflow in expat_realloc since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102623 medium kubevirt: kubevirt: virt-controller nil-pointer dereference via malformed ephemeral volume since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-97711 medium serialize-javascript: serialize-javascript: Cross-Site Scripting via unescaped script-closing tags in serialized functions since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-97688 medium urllib3: urllib3: Denial of Service via infinite loop during chunked Deflate decoding since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-84784 medium openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-84783 medium openssl: openssl: Denial of Service via race condition in certificate extension caching since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-77696 medium openssl: OpenSSL: Private key recovery via SM2 timing side-channel since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-75806 medium openssl: OpenSSL: Denial of Service via undersized DTLS record since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-75805 medium openssl: openssl: Denial of Service via crafted CMP certificate revocation response since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-75804 medium openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-72897 medium openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-54875 medium openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-54873 medium openssl: openssl: Denial of Service via excessive QUIC packet buffer retention since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-54872 medium openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-42772 medium openssl: openssl: Denial of Service via inefficient QUIC stream reassembly since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102598 medium werkzeug: werkzeug: Denial of Service via safe_join() Windows special device paths since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-102371 medium In wsl-pro-service before 0.1.19ubuntu3, the service component wh ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-98164 medium kernel: KVM: x86/mmu: Check write tracking in all address spaces since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-96869 medium firefox: thunderbird: Information disclosure in the Networking component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100828 medium Mitigation bypass in the Bookmarks & History component. This vulnerabi ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100825 medium Use-after-free in the JavaScript Engine: JIT component. This vulnerabi ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100824 medium Privilege escalation in the Places component. This vulnerability was f ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100821 medium firefox: thunderbird: Site isolation issue in the Panning and Zooming component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100820 medium firefox: thunderbird: Privilege escalation in the Address Bar component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100819 medium firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the XPCOM component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100818 medium firefox: thunderbird: Sandbox escape due to use-after-free in the Widget: Gtk component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100817 medium Other issue in the JavaScript: WebAssembly component. This vulner ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100816 medium firefox: Site isolation issue in the DOM: Networking component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100815 medium firefox: Use-after-free in the CSS Parsing and Computation component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100814 medium firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100813 medium firefox: Invalid pointer in the JavaScript Engine: JIT component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100812 medium firefox: Denial-of-service in the Graphics component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100810 medium firefox: Other issue in the DevTools component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100809 medium Same-origin policy bypass in the DevTools component. This vulnerabilit ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100808 medium Mitigation bypass in the DOM: Service Workers component. This vulnerab ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100807 medium firefox: thunderbird: Privilege escalation in the DOM: Service Workers component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100806 medium Uninitialized memory in the Graphics: WebGPU component. This vulnerabi ... since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100805 medium firefox: Race condition, use-after-free in the Audio/Video component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100804 medium firefox: Sandbox escape due to use-after-free in the Preferences: Backend component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100803 medium firefox: thunderbird: Same-origin policy bypass in the WebExtensions component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100802 medium firefox: Uninitialized memory in the Graphics: WebGPU component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100801 medium firefox: thunderbird: Privilege escalation in the DLL Services component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100800 medium firefox: Sandbox escape due to use-after-free in the Disability Access APIs component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 CVE-2026-100799 medium firefox: Uninitialized memory in the Graphics: WebGPU component since at least 24 Oct 2026 07:11 UTC build 29 Sep 2026 