Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91715 | high | 8.8 | No | Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb... | 2026-09-17 |
| CVE-2026-91714 | medium | 5.3 | No | Observable discrepancy in Fonts in Google Chrome prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to leak sens... | 2026-09-17 |
| CVE-2026-91713 | medium | 4.2 | No | Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process... | 2026-09-17 |
| CVE-2026-91712 | high | 8.3 | No | Race condition in Extensions in Google Chrome on on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer pr... | 2026-09-17 |
| CVE-2026-91711 | high | 8.8 | No | Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the... | 2026-09-17 |
| CVE-2026-91710 | critical | 9.6 | No | Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code outside the san... | 2026-09-17 |
| CVE-2026-91709 | high | 8.8 | No | Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandb... | 2026-09-17 |
| CVE-2026-91708 | low | 3.1 | No | Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obta... | 2026-09-17 |
| CVE-2026-89328 | low | 3.8 | No | The FluentBoards WordPress plugin before 2.0.15 does not properly verify that a user holds board-manager privileges before performing severa... | 2026-09-17 |
| CVE-2026-89327 | low | 3.8 | No | The FluentBoards WordPress plugin before 2.0.15 does not verify that a board member submitting a comment is the user the comment is attribut... | 2026-09-17 |
| CVE-2026-88910 | medium | 5.3 | No | The kboard WordPress plugin before 6.7 does not verify ownership or context before deleting board media, allowing unauthenticated attackers... | 2026-09-17 |
| CVE-2026-87959 | medium | 5.4 | No | The WPBot WordPress plugin before 8.7.6 does not perform a capability check on the AJAX action that saves its Claude AI provider settings, a... | 2026-09-17 |
| CVE-2026-87907 | medium | 5.3 | No | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoints that return booking serv... | 2026-09-17 |
| CVE-2026-87896 | medium | 5.3 | No | The Rox Appointment Booking WordPress plugin before 1.2.8 does not perform any authorization check on the endpoint that returns booking agen... | 2026-09-17 |
| CVE-2026-87860 | medium | 4.3 | No | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscriptio... | 2026-09-17 |
| CVE-2026-87854 | medium | 5.3 | No | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not correctly validate the shared secret protecting one of its REST end... | 2026-09-17 |
| CVE-2026-87828 | medium | 5.7 | No | The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, all... | 2026-09-17 |
| CVE-2026-86823 | medium | 5.3 | No | The Newsletter WordPress plugin before 9.3.7 does not validate the destination of the redirect performed after a public subscription action,... | 2026-09-17 |
| CVE-2026-86784 | medium | 6.8 | No | The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back... | 2026-09-17 |
| CVE-2026-86449 | medium | 5.3 | No | The LearnPress WordPress plugin before 4.4.7 does not check the user's capabilities before applying a user supplied post status filter in on... | 2026-09-17 |