Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19985 | medium | 6.1 | No | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28... | 2026-09-11 |
| CVE-2026-18121 | not reported | — | No | Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/... | 2026-09-11 |
| CVE-2026-19136 | high | 7.8 | No | A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese marke... | 2026-09-11 |
| CVE-2026-18994 | high | 7.1 | No | A potential improper authorization vulnerability was reported in the Lenovo File Manager Android Application, distributed exclusively in the... | 2026-09-11 |
| CVE-2026-15462 | high | 7.5 | No | The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scw_form_fields' parameter array keys of the 'scw_save_f... | 2026-09-11 |
| CVE-2026-11813 | high | 7.8 | No | A potential improper permissions vulnerability was reported in the Lenovo Filez Client application that could allow a local authenticated us... | 2026-09-11 |
| CVE-2026-87584 | medium | 6.5 | No | Incorrect authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions into... | 2026-09-11 |
| CVE-2026-73784 | high | 8.8 | No | A potential security vulnerability in HPE IceWall products could be exploited to tamper SAML response, allowing an attacker to impersonate a... | 2026-09-11 |
| CVE-2026-11765 | low | 3.3 | No | Improper neutralization of argument delimiters in a command ('argument injection') vulnerability in TUBITAK BILGEM Software Technologies Res... | 2026-09-11 |
| CVE-2026-87580 | medium | 6.5 | No | Incorrect authorization in WebAppInstalls in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer... | 2026-09-11 |
| CVE-2026-87589 | medium | 6.5 | No | Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer... | 2026-09-11 |
| CVE-2026-77106 | high | 8.8 | No | Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintena... | 2026-09-11 |
| CVE-2026-77089 | critical | 9.8 | No | Command Center API contained an authentication bypass issue affecting privilege management. Software customers upgrade to resolved maintenan... | 2026-09-11 |
| CVE-2026-77091 | high | 7.8 | No | DataCube contained a path traversal issue affecting security feature enforcement. Software customers upgrade to resolved maintenance release... | 2026-09-11 |
| CVE-2026-77092 | critical | 9.8 | No | Content Extractor contained a deserialization of untrusted data issue affecting privilege management. Software customers upgrade to resolved... | 2026-09-11 |
| CVE-2026-77097 | high | 8.2 | No | Private Metrics Server contained a missing authentication condition affecting metrics upload functionality and service availability. Softwar... | 2026-09-11 |
| CVE-2026-77098 | critical | 9.8 | No | Private Metrics Server contained an SQL injection condition affecting database operations. Software customers upgrade to resolved maintenanc... | 2026-09-11 |
| CVE-2026-85239 | medium | 6.5 | No | A vulnerability in MISP's event template handling allowed an authenticated user with permission to create or modify event templates to bypas... | 2026-09-11 |
| CVE-2026-83999 | high | 7.0 | No | Improper link resolution before file access ('link following') in Windows Resilient File System (ReFS) Deduplication Service allows an autho... | 2026-09-11 |
| CVE-2026-81789 | high | 8.6 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Studio Wombat Advanced Product Fields Extend... | 2026-09-11 |