Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84761 | high | 7.2 | No | Unauthenticated Server Side Request Forgery (SSRF) in LiteSpeed Cache <= 7.9 versions. | 2026-09-04 |
| CVE-2026-84754 | medium | 6.5 | No | Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. | 2026-09-04 |
| CVE-2026-81776 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP QuickLaTeX <= 3.8.8 versions. | 2026-09-04 |
| CVE-2026-81282 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Product Variations Swatches for WooCommerce <= 1.1.18 versions. | 2026-09-04 |
| CVE-2019-3773 | critical | 9.8 | No | Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity In... | 2026-09-04 |
| CVE-2026-33228 | critical | 9.8 | No | flatted is a circular JSON parser. Prior to version 3.4.2, the parse() function in flatted can use attacker-controlled string values from th... | 2026-09-04 |
| CVE-2026-80752 | high | 8.4 | No | In the Linux kernel, the following vulnerability has been resolved: Input: psxpad-spi - set driver data before use psxpad_spi_suspend() re... | 2026-09-04 |
| CVE-2026-80751 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: mfg: initialize prev_o in mtk_mfg_attach_dev() mtk... | 2026-09-04 |
| CVE-2026-80750 | high | 8.4 | No | In the Linux kernel, the following vulnerability has been resolved: pmdomain: mediatek: fix remaining %pOF after of_node_put() scpsys_get_... | 2026-09-04 |
| CVE-2026-80749 | high | 7.1 | No | In the Linux kernel, the following vulnerability has been resolved: drm/connector/hdmi: Fix out of bounds memory read A helper function wa... | 2026-09-04 |
| CVE-2026-80748 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: mmc: loongson2: Fix sg iteration in data reorder functions In ls2k0500... | 2026-09-04 |
| CVE-2026-80745 | high | 8.4 | No | In the Linux kernel, the following vulnerability has been resolved: regulator: fp9931: Fix VPOS/VNEG voltage selector table The VPOSNEG_ta... | 2026-09-04 |
| CVE-2026-80741 | high | 7.1 | No | In the Linux kernel, the following vulnerability has been resolved: drm/log: Fix out-of-bounds read on empty message length drm_log_draw_k... | 2026-09-04 |
| CVE-2026-80736 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix bandwidth group reservation indexing Valid bandwidth... | 2026-09-04 |
| CVE-2026-80735 | high | 7.3 | No | In the Linux kernel, the following vulnerability has been resolved: ovpn: ensure socket is owned by ovpn before deref sk_user_data Some su... | 2026-09-04 |
| CVE-2026-80732 | high | 7.8 | No | In the Linux kernel, the following vulnerability has been resolved: ata: pata_sl82c105: fix bridge revision use-after-free pci_get_slot()... | 2026-09-04 |
| CVE-2026-84804 | medium | 5.4 | No | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoint... | 2026-09-04 |
| CVE-2026-84799 | medium | 4.3 | No | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draf... | 2026-09-04 |
| CVE-2026-84794 | high | 7.1 | No | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users... | 2026-09-04 |
| CVE-2026-84780 | medium | 5.3 | No | Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. | 2026-09-04 |