Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85207 | low | 3.5 | No | A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q... | 2026-09-05 |
| CVE-2026-85309 | medium | 5.3 | No | Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security... | 2026-09-05 |
| CVE-2026-85305 | medium | 5.4 | No | Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a thro... | 2026-09-05 |
| CVE-2026-84847 | high | 7.5 | No | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | 2026-09-05 |
| CVE-2026-84812 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | 2026-09-05 |
| CVE-2026-84774 | medium | 6.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. | 2026-09-05 |
| CVE-2026-84766 | medium | 5.9 | No | Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | 2026-09-05 |
| CVE-2026-84758 | medium | 6.5 | No | Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | 2026-09-05 |
| CVE-2026-84753 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | 2026-09-05 |
| CVE-2026-85137 | high | 7.3 | No | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the... | 2026-09-05 |
| CVE-2026-85106 | medium | 6.3 | No | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap... | 2026-09-05 |
| CVE-2026-81773 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | 2026-09-05 |
| CVE-2026-81281 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Graphene <= 2.9.4 versions. | 2026-09-05 |
| CVE-2026-85030 | low | 3.7 | No | A vulnerability has been found in HKUDS AI-Trader up to d03ff6c056b32ced735adf7c19ed8175adb1c8df. The affected element is an unknown functio... | 2026-09-05 |
| CVE-2026-84886 | medium | 5.3 | No | A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_a... | 2026-09-05 |
| CVE-2026-84841 | high | 7.3 | No | A security flaw has been discovered in tsi-coop tsi-dpdp-cms up to 0.5.0. This vulnerability affects unknown code. The manipulation results... | 2026-09-05 |
| CVE-2026-52022 | high | 7.5 | No | An issue in kamailio v.6.1.1 and before allows a remote attacker to cause a denial of service via the IMS P-CSCF registration handling compo... | 2026-09-04 |
| CVE-2026-52130 | high | 7.5 | No | llama.cpp b5693 and before is vulnerable to Uncontrolled Recursion in common/json-schema-to-grammar.cpp, resulting in a denial of service. | 2026-09-04 |
| CVE-2026-72676 | critical | 9.1 | No | Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-supplied script con... | 2026-09-04 |
| CVE-2026-52131 | high | 7.5 | No | llama.cpp b5693 and before has a Reachable Assertion via the gguf_reader::read function. | 2026-09-04 |