Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85513 | medium | 6.3 | No | A weakness has been identified in StackStorm st2 up to 3.9.0. This issue affects the function assert_user_is_admin_if_user_query_param_is_pr... | 2026-09-08 |
| CVE-2026-18021 | medium | 6.5 | No | The The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in a... | 2026-09-08 |
| CVE-2026-16502 | high | 8.8 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and inc... | 2026-09-08 |
| CVE-2026-19887 | high | 8.8 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.1 via deseriali... | 2026-09-08 |
| CVE-2026-19769 | high | 7.2 | No | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeate... | 2026-09-08 |
| CVE-2026-16649 | high | 7.2 | No | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and inc... | 2026-09-08 |
| CVE-2026-14444 | high | 7.5 | No | The WP Fusion (Pro) plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to... | 2026-09-08 |
| CVE-2026-12853 | medium | 5.4 | No | The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plug... | 2026-09-08 |
| CVE-2026-15984 | high | 7.2 | No | The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and includ... | 2026-09-08 |
| CVE-2026-17259 | medium | 6.5 | No | IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to cause a denial of service due to a stack-based buffer overflow. | 2026-09-08 |
| CVE-2026-62916 | critical | 9.8 | No | Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a... | 2026-09-08 |
| CVE-2026-78583 | high | 8.1 | No | Incorrect Authorization (CWE-863) in Kibana can lead to privilege escalation via Input Data Manipulation (CAPEC-153). Elasticsearch cluster... | 2026-09-08 |
| CVE-2026-85042 | critical | 9.6 | No | Use after free in DevTools in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code outside the sandbox v... | 2026-09-08 |
| CVE-2026-85043 | critical | 9.1 | No | Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to bypass system access restrictions via cra... | 2026-09-08 |
| CVE-2026-85044 | medium | 6.5 | No | Use of released resource in Mobile in Google Chrome on on Android prior to 152.0.7977.82 allowed a remote attacker leveraging social enginee... | 2026-09-08 |
| CVE-2026-85045 | high | 7.5 | No | Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a cr... | 2026-09-08 |
| CVE-2026-85047 | critical | 9.6 | No | Improper input validation in Transactions Platform in Google Chrome on on iOS prior to 152.0.7977.82 allowed a remote attacker to potentiall... | 2026-09-08 |
| CVE-2026-85048 | high | 8.3 | No | Use after free in Compositing in Google Chrome prior to 152.0.7977.82 allowed a remote attacker who had compromised the renderer process to... | 2026-09-08 |
| CVE-2026-85049 | high | 8.8 | No | Use after free in Skia in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a... | 2026-09-08 |
| CVE-2026-86306 | high | 7.3 | No | A weakness has been identified in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This affe... | 2026-09-08 |