Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84764 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions. | 2026-09-04 |
| CVE-2026-84441 | high | 7.3 | No | A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of... | 2026-09-04 |
| CVE-2026-84427 | medium | 4.3 | No | A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the... | 2026-09-04 |
| CVE-2026-84287 | medium | 4.3 | No | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platform... | 2026-09-04 |
| CVE-2026-84269 | medium | 6.5 | No | A flaw was found in the AFP backend in gvfs. When mounting a share, a malicious AFP server can cause the DSI read path to process a length t... | 2026-09-04 |
| CVE-2026-81775 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. | 2026-09-04 |
| CVE-2026-81769 | high | 8.8 | No | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from... | 2026-09-04 |
| CVE-2026-81286 | critical | 9.3 | No | Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. | 2026-09-04 |
| CVE-2026-3850 | medium | 6.4 | No | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` short... | 2026-09-04 |
| CVE-2026-14982 | high | 8.1 | No | The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete fu... | 2026-09-04 |
| CVE-2026-84110 | medium | 5.3 | No | A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Valida... | 2026-09-04 |
| CVE-2026-3851 | medium | 6.4 | No | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versio... | 2026-09-03 |
| CVE-2026-78600 | low | 3.5 | No | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentic... | 2026-09-03 |
| CVE-2026-78594 | medium | 4.9 | No | Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAP... | 2026-09-03 |
| CVE-2026-78588 | medium | 6.5 | No | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-1... | 2026-09-03 |
| CVE-2026-78587 | low | 3.1 | No | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122)... | 2026-09-03 |
| CVE-2026-84637 | critical | 9.8 | No | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbir... | 2026-09-03 |
| CVE-2026-84639 | critical | 9.1 | No | Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbir... | 2026-09-03 |
| CVE-2026-84640 | high | 7.5 | No | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 15... | 2026-09-03 |
| CVE-2026-84641 | high | 7.5 | No | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately... | 2026-09-03 |