Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-21108 | medium | 5.5 | No | Improper export of android application components in Bixby Touch prior to version 4.3.01.17 allows local attackers to access sensitive infor... | 2026-09-23 |
| CVE-2026-21112 | medium | 5.5 | No | Improper input validation in Samsung Tips prior to Android 17 allows local attackers to launch arbitrary activity with Samsung Tips privileg... | 2026-09-23 |
| CVE-2026-77860 | low | 3.7 | No | In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the... | 2026-09-23 |
| CVE-2026-21107 | medium | 5.5 | No | Out-of-bounds write in Samsung Notes prior to version 4.4.45.5 allows local attackers to write out-of-bounds memory. | 2026-09-23 |
| CVE-2026-77955 | medium | 4.4 | No | In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, a vulnerability in ZONEMD configured zones (zonemd-check: yes) which are located be... | 2026-09-23 |
| CVE-2026-21105 | medium | 5.5 | No | Improper access control in Collection prior to version 1.0.1.14 in Android 15 and 2.0.02.7 in Android 16 allows local attackers to access se... | 2026-09-23 |
| CVE-2026-96756 | high | 8.1 | No | orval versions before 8.30.0 contain a code injection vulnerability in the @orval/core factory generator that fails to escape date default v... | 2026-09-23 |
| CVE-2026-96549 | low | 3.3 | No | A vulnerability has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This vulnerability affects unknown cod... | 2026-09-23 |
| CVE-2026-95603 | high | 7.2 | No | Shop manager PHP Object Injection in Reycob Product Import Export <= 2.3.0 versions. | 2026-09-23 |
| CVE-2026-95600 | medium | 5.3 | No | Unauthenticated Sensitive Data Exposure in TrustedLogin Connector <= 2.0.3 versions. | 2026-09-23 |
| CVE-2026-95592 | medium | 5.3 | No | Unauthenticated Insecure Direct Object References (IDOR) in Team <= 6.0.0 versions. | 2026-09-23 |
| CVE-2026-96514 | high | 7.3 | No | A weakness has been identified in Neethuharii CafeManagement. Impacted is an unknown function of the file CafePortalLogin.php of the compone... | 2026-09-23 |
| CVE-2026-95530 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in PixelYourSite – Your smart PIXEL (TAG) Manager <= 11.4.1 versions. | 2026-09-23 |
| CVE-2026-95528 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions. | 2026-09-23 |
| CVE-2026-95524 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95522 | high | 7.6 | No | Shop manager SQL Injection in Easy Digital Downloads <= 3.7.0 versions. | 2026-09-23 |
| CVE-2026-95513 | high | 7.5 | No | Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions. | 2026-09-23 |
| CVE-2026-94682 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Podcast Importer SecondLine <= 1.5.6 versions. | 2026-09-23 |
| CVE-2026-94671 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | 2026-09-23 |
| CVE-2026-94498 | medium | 6.5 | No | Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | 2026-09-23 |