Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-3096 | medium | 4.7 | No | The product's web portals allow external links to be opened in a new browser tab. In certain configurations, the originating window retains... | 2026-09-18 |
| CVE-2026-81902 | high | 8.1 | No | Concrete CMS 9 through 9.5.2 did not validate a CSRF token in the orphaned block removal panel action (removeOrphanedBlocks). A remote attac... | 2026-09-18 |
| CVE-2026-81903 | medium | 5.4 | No | Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the... | 2026-09-18 |
| CVE-2026-16515 | medium | 4.7 | No | net_icmpv6_send_error() in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules (do not answer an... | 2026-09-18 |
| CVE-2026-16514 | medium | 4.3 | No | gptp_mi_qualify_announce() in subsys/net/l2/ethernet/gptp/gptp_mi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, co... | 2026-09-18 |
| CVE-2026-16512 | low | 3.1 | No | gptp_handle_msg() in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTP_HDR() and switched on hdr->message_typ... | 2026-09-18 |
| CVE-2026-14986 | medium | 6.8 | No | The ITE it51xxx I2C driver, when operating as an I2C target (slave) in buffer mode (CONFIG_I2C_TARGET + CONFIG_I2C_TARGET_BUFFER_MODE), copi... | 2026-09-18 |
| CVE-2026-19781 | high | 7.8 | No | Ashlar-Vellum Cobalt VS File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attack... | 2026-09-18 |
| CVE-2026-19774 | high | 7.1 | No | BlueZ A2DP Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute... | 2026-09-18 |
| CVE-2026-19773 | critical | 9.8 | No | libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. This vulnerability allows remote att... | 2026-09-18 |
| CVE-2026-19504 | medium | 4.0 | No | Fabric.js loadFromJSON Server-Side Request Forgery Vulnerability. This vulnerability allows remote attackers to disclose sensitive informati... | 2026-09-18 |
| CVE-2026-90977 | medium | 5.3 | No | The Clean Login WordPress plugin before 1.19 does not verify its registration CAPTCHA when the stored session value is empty, allowing unaut... | 2026-09-18 |
| CVE-2026-90976 | medium | 5.3 | No | The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registrat... | 2026-09-18 |
| CVE-2026-88994 | medium | 6.6 | No | The All Bootstrap Blocks WordPress plugin through 1.3.31 does not validate a block attribute before using it to build a filesystem path that... | 2026-09-18 |
| CVE-2026-86800 | medium | 5.3 | No | The Hide My WP Ghost WordPress plugin before 7.0.11 does not properly validate a loopback security-check request before disabling its login... | 2026-09-18 |
| CVE-2026-86796 | medium | 5.3 | No | The Hide My WP Ghost WordPress plugin before 7.0.11 does not verify that a request is a genuine WooCommerce request before disabling its fir... | 2026-09-18 |
| CVE-2026-79713 | medium | 6.5 | No | The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while stil... | 2026-09-18 |
| CVE-2026-90984 | medium | 5.8 | No | The Generate PDF using Contact Form 7 WordPress plugin before 4.2.2 does not restrict the destination of the image fetch its PDF renderer pe... | 2026-09-18 |
| CVE-2026-90978 | high | 7.1 | No | The Filter Gallery WordPress plugin before 1.1.5 does not verify the nonce on several of its AJAX handlers when the nonce field is omitted,... | 2026-09-18 |
| CVE-2026-89008 | low | 2.7 | No | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointmen... | 2026-09-18 |