Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91921 | not reported | — | No | Cross-Site Scripting (XSS) vulnerability due to inadequate input sanitisation in the client-side rendering engine of the 1millionbot AI Chat... | 2026-09-22 |
| CVE-2026-92400 | medium | 5.3 | No | The Payment Gateway for PayPal on WooCommerce WordPress plugin before 9.2.1 does not verify that an incoming payment notification was confir... | 2026-09-22 |
| CVE-2026-92254 | not reported | — | No | Missing Authorization in the IOCTL handlers of the wsdkd.sys kernel drivers in Watchdog WatchDog Antivirus 1.8.640 (driver versions 1.3.0.0... | 2026-09-22 |
| CVE-2026-92253 | not reported | — | No | Improper link resolution before file access in the quarantine restoration process of WatchDog Anti-Virus 1.8.640 on Windows allows local, lo... | 2026-09-22 |
| CVE-2026-92252 | not reported | — | No | Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, r... | 2026-09-22 |
| CVE-2026-86555 | medium | 6.2 | No | The ZTE SmartLife application has a hardcoded key. The key used to decrypt account server information is stored in plaintext in the code. On... | 2026-09-22 |
| CVE-2026-86554 | medium | 4.3 | No | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained... | 2026-09-22 |
| CVE-2026-92965 | low | 3.7 | No | The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so... | 2026-09-22 |
| CVE-2026-86553 | high | 8.8 | No | SmartLife app dynamically generates fresh SmartLife application authentication parameters inside its runtime process. Using the acquired Sma... | 2026-09-22 |
| CVE-2026-86552 | medium | 5.4 | No | SmartLife app dynamically generates brand‑new SmartLife application authentication parameters at runtime. With the acquired SmartLife applic... | 2026-09-22 |
| CVE-2026-86551 | low | 3.3 | No | The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read... | 2026-09-22 |
| CVE-2026-87144 | high | 7.6 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-17054 | medium | 5.3 | No | The Espressif ESP-hosted Wi-Fi driver (drivers/wifi/esp_hosted/) parses frames received over SPI from the ESP co-processor in esp_hosted_eve... | 2026-09-22 |
| CVE-2026-17052 | high | 7.8 | No | The Time-aware GPIO syscall verification handler z_vrfy_tgpio_pin_read_ts_ec() in drivers/timeaware_gpio/timeaware_gpio_handlers.c validated... | 2026-09-22 |
| CVE-2026-17051 | medium | 6.0 | No | The Intel SEDI IPM (inter-processor mailbox) driver in drivers/ipm/ipm_sedi.c handles an inbound message interrupt in ipm_event_dispose(). I... | 2026-09-22 |
| CVE-2026-17050 | medium | 5.7 | No | The experimental USB host stack allocates a per-device configuration-descriptor buffer, udev->cfg_desc, from the dedicated usb_device_heap i... | 2026-09-22 |
| CVE-2026-87142 | high | 7.1 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-87146 | high | 7.1 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-87135 | high | 7.1 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |
| CVE-2026-87134 | high | 7.7 | No | Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security). The supported... | 2026-09-22 |