Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76958 | high | 8.5 | No | SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attack... | 2026-09-08 |
| CVE-2026-58234 | low | 2.2 | No | SAP Process Integration (SOAP Adapter) allows a privileged user to send specially crafted requests containing deeply nested entity definitio... | 2026-09-08 |
| CVE-2026-44766 | medium | 6.5 | No | SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain fun... | 2026-09-08 |
| CVE-2026-81939 | critical | 9.1 | No | A Zip Slip vulnerability in the SonicWall Network Security Manager (NSM) On-Prem file upload and archive processing functionality allows an... | 2026-09-08 |
| CVE-2026-78328 | critical | 9.1 | No | A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged... | 2026-09-08 |
| CVE-2026-78327 | critical | 9.1 | No | An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in the SonicWall Network Securit... | 2026-09-08 |
| CVE-2026-49509 | medium | 4.4 | No | Out-of-bounds read vulnerability in Samsung Opensource rLottie allows Overread Buffers. This issue affects rLottie: 25648aef19187b3f87f4d94... | 2026-09-08 |
| CVE-2026-85084 | medium | 6.3 | No | Out-of-bounds Write and Improper Validation of Array Index vulnerability in Samsung Open Source TizenFX Samsung/TizenFX allows Overflow Buff... | 2026-09-08 |
| CVE-2026-80439 | medium | 4.8 | No | The Redirection for Contact Form 7 WordPress plugin from 2.2.7 before 3.2.11 does not prevent shortcodes in submitted form values from being... | 2026-09-08 |
| CVE-2026-80437 | medium | 4.8 | No | The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when i... | 2026-09-08 |
| CVE-2026-19862 | medium | 4.8 | No | The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form... | 2026-09-08 |
| CVE-2026-19859 | medium | 6.5 | No | The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing un... | 2026-09-08 |
| CVE-2026-84219 | high | 7.5 | No | The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthent... | 2026-09-08 |
| CVE-2026-84028 | medium | 6.8 | No | The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attri... | 2026-09-08 |
| CVE-2026-75793 | medium | 6.5 | No | The SureCart WordPress plugin before 4.7.0 does not consult the site's user registration setting before creating WordPress accounts, allowin... | 2026-09-08 |
| CVE-2026-18480 | high | 8.8 | No | The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission... | 2026-09-08 |
| CVE-2026-13159 | medium | 4.3 | No | The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authe... | 2026-09-08 |
| CVE-2026-84927 | low | 2.7 | No | The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes,... | 2026-09-08 |
| CVE-2026-84926 | low | 2.7 | No | The EmbedPress WordPress plugin before 4.6.4 does not correctly restrict access to one of its Google Reviews REST routes to administrators,... | 2026-09-08 |
| CVE-2026-84901 | medium | 4.9 | No | The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing us... | 2026-09-08 |