Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84804 | medium | 5.4 | No | Kimai before 2.65.0 fails to properly validate permissions when removing team access to activities, projects, and customers via API endpoint... | 2026-09-04 |
| CVE-2026-84799 | medium | 4.3 | No | Craft CMS before 5.11.0 fails to enforce user-group scope filters on native GraphQL user relations including author, authors, uploader, draf... | 2026-09-04 |
| CVE-2026-84794 | high | 7.1 | No | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users... | 2026-09-04 |
| CVE-2026-84780 | medium | 5.3 | No | Unauthenticated Denial of Service Attack in WP Go Maps <= 10.1.08 versions. | 2026-09-04 |
| CVE-2026-84764 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Simply Schedule Appointments <= 1.6.12.23 versions. | 2026-09-04 |
| CVE-2026-84441 | high | 7.3 | No | A security vulnerability has been detected in Piwigo up to 16.3.0. Affected by this issue is some unknown functionality of the file i.php of... | 2026-09-04 |
| CVE-2026-84427 | medium | 4.3 | No | A vulnerability was determined in zhayujie CowAgent up to 2.1.7. Affected is an unknown function of the file agent/tools/bash/bash.py of the... | 2026-09-04 |
| CVE-2026-84287 | medium | 4.3 | No | A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platform... | 2026-09-04 |
| CVE-2026-81775 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions. | 2026-09-04 |
| CVE-2026-81769 | high | 8.8 | No | Incorrect Privilege Assignment vulnerability in LiquidThemes Booking Hub allows Privilege Escalation. This issue affects Booking Hub: from... | 2026-09-04 |
| CVE-2026-81286 | critical | 9.3 | No | Unauthenticated SQL Injection in WCFM Marketplace <= 3.8.1 versions. | 2026-09-04 |
| CVE-2026-3850 | medium | 6.4 | No | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` short... | 2026-09-04 |
| CVE-2026-14982 | high | 8.1 | No | The WP File Download plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete fu... | 2026-09-04 |
| CVE-2026-84110 | medium | 5.3 | No | A vulnerability was detected in Releasit Releasit COD Form & Upsells v1. This vulnerability affects unknown code of the component OTP Valida... | 2026-09-04 |
| CVE-2026-3851 | medium | 6.4 | No | The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versio... | 2026-09-03 |
| CVE-2026-78600 | low | 3.5 | No | Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privilege Abuse (CAPEC-122). Authentic... | 2026-09-03 |
| CVE-2026-78594 | medium | 4.9 | No | Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excessive Allocation (CAP... | 2026-09-03 |
| CVE-2026-78588 | medium | 6.5 | No | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-1... | 2026-09-03 |
| CVE-2026-78587 | low | 3.1 | No | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122)... | 2026-09-03 |
| CVE-2026-84637 | critical | 9.8 | No | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbir... | 2026-09-03 |