Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84642 | high | 7.5 | No | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some pos... | 2026-09-03 |
| CVE-2026-84130 | high | 7.5 | No | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, a... | 2026-09-03 |
| CVE-2026-84132 | high | 7.5 | No | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, a... | 2026-09-03 |
| CVE-2026-84133 | critical | 9.8 | No | Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 1... | 2026-09-03 |
| CVE-2026-84134 | critical | 9.8 | No | Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbir... | 2026-09-03 |
| CVE-2026-85307 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. Thi... | 2026-09-03 |
| CVE-2026-85304 | medium | 5.3 | No | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiti... | 2026-09-03 |
| CVE-2026-85303 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Man... | 2026-09-03 |
| CVE-2026-84849 | medium | 6.5 | No | Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. | 2026-09-03 |
| CVE-2026-84836 | high | 7.1 | No | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. | 2026-09-03 |
| CVE-2026-84814 | critical | 9.8 | No | Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. | 2026-09-03 |
| CVE-2026-84779 | high | 8.1 | No | Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | 2026-09-03 |
| CVE-2026-84777 | high | 7.4 | No | Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. | 2026-09-03 |
| CVE-2026-84773 | high | 7.2 | No | Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. | 2026-09-03 |
| CVE-2026-84768 | critical | 9.3 | No | Unauthenticated SQL Injection in VikAppointments Services Booking Calendar <= 1.2.20 versions. | 2026-09-03 |
| CVE-2026-84765 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Breadcrumb NavXT <= 7.5.1 versions. | 2026-09-03 |
| CVE-2026-84762 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in WP EasyPay <= 4.5.3 versions. | 2026-09-03 |
| CVE-2026-84757 | high | 8.2 | No | Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. | 2026-09-03 |
| CVE-2026-84755 | medium | 6.5 | No | Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. | 2026-09-03 |
| CVE-2026-84752 | high | 8.8 | No | Contributor PHP Object Injection in RTMKit <= 2.1.5 versions. | 2026-09-03 |