Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84812 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | 2026-09-05 |
| CVE-2026-84774 | medium | 6.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. | 2026-09-05 |
| CVE-2026-84766 | medium | 5.9 | No | Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | 2026-09-05 |
| CVE-2026-84758 | medium | 6.5 | No | Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | 2026-09-05 |
| CVE-2026-84753 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | 2026-09-05 |
| CVE-2026-85137 | high | 7.3 | No | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the... | 2026-09-05 |
| CVE-2026-85106 | medium | 6.3 | No | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap... | 2026-09-05 |
| CVE-2026-81773 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | 2026-09-05 |
| CVE-2026-81281 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | 2026-09-05 |
| CVE-2026-85030 | low | 3.7 | No | A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown functio... | 2026-09-05 |
| CVE-2026-84886 | medium | 5.3 | No | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_a... | 2026-09-05 |
| CVE-2026-84841 | high | 7.3 | No | A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results... | 2026-09-05 |
| CVE-2026-52022 | high | 7.5 | No | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling compo... | 2026-09-04 |
| CVE-2026-52130 | high | 7.5 | No | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. | 2026-09-04 |
| CVE-2026-72676 | critical | 9.1 | No | Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script con... | 2026-09-04 |
| CVE-2026-52131 | high | 7.5 | No | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. | 2026-09-04 |
| CVE-2026-84666 | medium | 5.4 | No | Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration th... | 2026-09-04 |
| CVE-2026-58566 | high | 8.8 | No | Dell PowerStore, an Incorrect Authorization vulnerability. A low privileged attacker with remote access could potentially exploit this vulne... | 2026-09-04 |
| CVE-2023-20577 | high | 7.4 | No | A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially res... | 2026-09-04 |
| CVE-2023-20576 | high | 7.7 | No | Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of ser... | 2026-09-04 |