Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84118 | medium | 5.4 | No | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunder... | 2026-09-02 |
| CVE-2026-84119 | critical | 9.6 | No | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Fire... | 2026-09-02 |
| CVE-2026-84120 | medium | 5.4 | No | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ES... | 2026-09-02 |
| CVE-2026-84121 | critical | 9.6 | No | Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefo... | 2026-09-02 |
| CVE-2026-73700 | critical | 9.0 | No | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator... | 2026-09-02 |
| CVE-2026-73701 | critical | 9.0 | No | An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could... | 2026-09-02 |
| CVE-2026-73710 | high | 8.2 | No | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of s... | 2026-09-02 |
| CVE-2026-84806 | medium | 5.4 | No | Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit... | 2026-09-02 |
| CVE-2026-84801 | high | 8.8 | No | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with adm... | 2026-09-02 |
| CVE-2026-84798 | high | 7.1 | No | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(... | 2026-09-02 |
| CVE-2026-84796 | high | 8.8 | No | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId... | 2026-09-02 |
| CVE-2026-84770 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. | 2026-09-02 |
| CVE-2026-84431 | medium | 4.4 | No | A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUt... | 2026-09-02 |
| CVE-2026-84289 | medium | 4.3 | No | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mc... | 2026-09-02 |
| CVE-2026-84288 | medium | 4.3 | No | A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_ad... | 2026-09-02 |
| CVE-2026-82223 | medium | 6.5 | No | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. | 2026-09-02 |
| CVE-2026-81770 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions. | 2026-09-02 |
| CVE-2026-81288 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions. | 2026-09-02 |
| CVE-2026-73745 | low | 3.1 | No | A vulnerability in the API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to view some informatio... | 2026-09-02 |
| CVE-2026-73727 | medium | 6.5 | No | Vulnerabilities in the API of HPE Networking Fabric Composer could allow an authenticated low privilege operator user to access sensitive in... | 2026-09-02 |