Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87136 | high | 7.5 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-93556 | not reported | — | No | The ‘/password/guardarClau/recover’ endpoint accepts the ‘usuariId’ parameter, which specifies the account whose password is to be changed.... | 2026-09-22 |
| CVE-2026-92438 | high | 8.8 | No | The Ninja Forms WordPress plugin 3.15.3 does not escape submitted form field values before outputting them on the submission edit screen in... | 2026-09-22 |
| CVE-2026-91827 | high | 7.5 | No | The Ninja Forms WordPress plugin 3.15.3 does not prevent user-submitted form field values from being deserialised when an administrator late... | 2026-09-22 |
| CVE-2026-88788 | medium | 6.8 | No | The Text Styler WordPress plugin through 1.1.1 does not sanitise and escape user-supplied styling values before outputting them within a fro... | 2026-09-22 |
| CVE-2026-85219 | low | 3.7 | No | Denial-of-Service in Redis module in Thinkst Canary's OpenCanary 0.9.9 allows an unauthenticated remote attacker cause unconstrained memory... | 2026-09-22 |
| CVE-2026-85220 | low | 3.7 | No | A vulnerability in the Thinkst Canary honeypot Redis service allows an unauthenticated remote attacker to execute a Denial-of-Service attack... | 2026-09-22 |
| CVE-2026-91921 | not reported | — | No | Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat... | 2026-09-22 |
| CVE-2026-92400 | medium | 5.3 | No | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confir... | 2026-09-22 |
| CVE-2026-92254 | not reported | — | No | Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0... | 2026-09-22 |
| CVE-2026-92253 | not reported | — | No | Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, lo... | 2026-09-22 |
| CVE-2026-92252 | not reported | — | No | Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, r... | 2026-09-22 |
| CVE-2026-86555 | medium | 6.2 | No | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. On... | 2026-09-22 |
| CVE-2026-86554 | medium | 4.3 | No | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained... | 2026-09-22 |
| CVE-2026-92965 | low | 3.7 | No | The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so... | 2026-09-22 |
| CVE-2026-86553 | high | 8.8 | No | SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired Sma... | 2026-09-22 |
| CVE-2026-86552 | medium | 5.4 | No | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife applic... | 2026-09-22 |
| CVE-2026-86551 | low | 3.3 | No | The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read... | 2026-09-22 |
| CVE-2026-87144 | high | 7.6 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-17054 | medium | 5.3 | No | The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_eve... | 2026-09-22 |