Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-7438 | medium | 6.4 | No | The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `supertitle` and `subtitle` attributes of t... | 2026-09-11 |
| CVE-2026-77111 | high | 8.7 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in a Security feature bypass. An attacker with high... | 2026-09-11 |
| CVE-2026-75738 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-09-11 |
| CVE-2026-75733 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-09-11 |
| CVE-2026-75709 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-75674 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-75668 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-75659 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-75639 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-6641 | medium | 6.4 | No | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_gallery' shortcode in versions up... | 2026-09-11 |
| CVE-2026-72627 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-72941 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-6640 | medium | 6.4 | No | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mla_link_attributes' parameter in all... | 2026-09-11 |
| CVE-2026-69777 | high | 8.0 | No | Heap-based buffer overflow in Windows DHCP Client allows an authorized attacker to elevate privileges over an adjacent network. | 2026-09-11 |
| CVE-2026-69352 | high | 7.8 | No | Heap-based buffer overflow in Windows Biometric Service allows an authorized attacker to elevate privileges locally. | 2026-09-11 |
| CVE-2026-19612 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-18964 | medium | 6.1 | No | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is... | 2026-09-11 |
| CVE-2026-12215 | medium | 5.3 | No | The OTP Login & Register Woocommerce plugin for WordPress is vulnerable to Authentication Bypass via OTP Brute Force in all versions up to,... | 2026-09-11 |
| CVE-2026-85238 | medium | 6.8 | No | MISP contains a session fixation vulnerability in the CustomAuth authentication (a custom configuration) flow. When a user was successfully... | 2026-09-11 |
| CVE-2026-85237 | high | 8.1 | No | A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed an attacker to perform an unrestricted number of O... | 2026-09-11 |