Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-6640 | medium | 6.4 | No | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all... | 2026-09-11 |
| CVE-2026-69777 | high | 8.0 | No | Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | 2026-09-11 |
| CVE-2026-69352 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-19612 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-18964 | medium | 6.1 | No | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is... | 2026-09-11 |
| CVE-2026-12215 | medium | 5.3 | No | The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to,... | 2026-09-11 |
| CVE-2026-85238 | medium | 6.8 | No | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully... | 2026-09-11 |
| CVE-2026-85237 | high | 8.1 | No | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of O... | 2026-09-11 |
| CVE-2026-85236 | high | 8.8 | No | A cross-site request forgery (CSRF) vulnerability existed in the cullEmptyEvents action of MISP. The endpoint performed a state-changing and... | 2026-09-11 |
| CVE-2026-87590 | medium | 5.9 | No | Improper input validation in Passwords in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive infor... | 2026-09-11 |
| CVE-2026-87591 | medium | 6.5 | No | Incorrect authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions... | 2026-09-11 |
| CVE-2026-19479 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-19232 | critical | 9.9 | No | Adobe Experience Manager is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the contex... | 2026-09-11 |
| CVE-2026-87603 | medium | 6.5 | No | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions v... | 2026-09-11 |
| CVE-2026-87610 | medium | 6.5 | No | Incorrect authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions in... | 2026-09-11 |
| CVE-2026-87626 | medium | 6.5 | No | Incorrect authorization in DeviceBoundSessionCredentials in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web ori... | 2026-09-11 |
| CVE-2026-87606 | high | 8.1 | No | Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer pr... | 2026-09-11 |
| CVE-2026-87600 | medium | 6.5 | No | Improper input validation in Safebrowsing in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social... | 2026-09-11 |
| CVE-2026-69773 | high | 8.0 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges over a network. | 2026-09-11 |
| CVE-2026-69593 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |