Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76759 | high | 7.3 | No | Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*. | 2026-09-02 |
| CVE-2026-76758 | medium | 5.9 | No | Vulnerability in Drupal Link content parser. This issue affects Link content parser versions: *.*. | 2026-09-02 |
| CVE-2026-73717 | high | 7.5 | No | A command injection vulnerability exists in the web-based management interface of HPE Networking Fabric Composer that could allow an unauthe... | 2026-09-02 |
| CVE-2026-73716 | high | 7.5 | No | A remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer that could allow an unauth... | 2026-09-02 |
| CVE-2026-51769 | critical | 9.8 | No | Incorrect access control in the remoteCloudUpdateCheck function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to res... | 2026-09-02 |
| CVE-2026-19591 | high | 8.8 | No | OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe bec... | 2026-09-02 |
| CVE-2026-78597 | medium | 4.3 | No | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality... | 2026-09-02 |
| CVE-2026-78607 | high | 7.1 | No | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-... | 2026-09-02 |
| CVE-2026-78605 | medium | 5.9 | No | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') (CWE-444) in Elasticsearch can lead to information disclosure via HT... | 2026-09-02 |
| CVE-2026-72654 | medium | 6.5 | No | Execution with Unnecessary Privileges (CWE-250) in the Kibana machine learning feature can lead to information disclosure via Privilege Abus... | 2026-09-02 |
| CVE-2026-72649 | high | 8.8 | No | Deserialization of Untrusted Data (CWE-502) in the Elasticsearch machine learning component can lead to remote code execution via Object Inj... | 2026-09-02 |
| CVE-2026-83744 | medium | 4.3 | No | A security vulnerability has been detected in invoiceninja Invoice Ninja up to 5.13.26. This vulnerability affects the function Purify::isHo... | 2026-09-02 |
| CVE-2026-77189 | medium | 6.5 | No | The Charitable – Donation & Fundraising Platform (Donation Forms, Recurring Donations & Fundraising Campaigns) plugin for WordPress is vulne... | 2026-09-02 |
| CVE-2026-76006 | medium | 4.9 | No | The Photo Gallery by Ays – Responsive Image Gallery plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in all... | 2026-09-02 |
| CVE-2026-51770 | critical | 9.8 | No | Incorrect access control in the sendToMasterQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to forw... | 2026-09-02 |
| CVE-2026-51765 | critical | 9.8 | No | Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to inser... | 2026-09-02 |
| CVE-2026-18550 | critical | 9.8 | No | The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and in... | 2026-09-02 |
| CVE-2026-19806 | high | 8.8 | No | The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentic... | 2026-09-02 |
| CVE-2026-16787 | medium | 6.4 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field'... | 2026-09-02 |
| CVE-2026-51768 | high | 7.5 | No | Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify p... | 2026-09-02 |