Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78588 | medium | 6.5 | No | Allocation of Resources Without Limits or Throttling (CWE-770) in Filebeat can lead to a denial of service via Excessive Allocation (CAPEC-1... | 2026-09-03 |
| CVE-2026-78587 | low | 3.1 | No | Incorrect Authorization (CWE-863) in Fleet Server can lead to a denial of service of agent upload operations via Privilege Abuse (CAPEC-122)... | 2026-09-03 |
| CVE-2026-84637 | critical | 9.8 | No | Malicious calendar invitations could use file URI attachments to launch local or network-hosted executables on Windows, bypassing Thunderbir... | 2026-09-03 |
| CVE-2026-84639 | critical | 9.1 | No | Triggering an error condition in certain MIME bodies would cause uninitialized memory to be used. This vulnerability was fixed in Thunderbir... | 2026-09-03 |
| CVE-2026-84640 | high | 7.5 | No | A maliciously constructed mail header could lead to a one byte read past the end of a buffer. This vulnerability was fixed in Thunderbird 15... | 2026-09-03 |
| CVE-2026-84641 | high | 7.5 | No | A malicious IMAP server can trigger use-after-free and heap-memory disclosure by sending a crafted ID response. Heap contents can ultimately... | 2026-09-03 |
| CVE-2026-84642 | high | 7.5 | No | The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some pos... | 2026-09-03 |
| CVE-2026-84130 | high | 7.5 | No | Information disclosure in the Graphics: WebGPU component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, a... | 2026-09-03 |
| CVE-2026-84132 | high | 7.5 | No | Information disclosure in the Networking: HTTP component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, a... | 2026-09-03 |
| CVE-2026-84133 | critical | 9.8 | No | Site isolation issue in the DOM: Push Subscriptions component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 1... | 2026-09-03 |
| CVE-2026-84134 | critical | 9.8 | No | Other issue in the Profile Backup component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbir... | 2026-09-03 |
| CVE-2026-85307 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Kevin Pirnie KP Agent Ready allows Retrieve Embedded Sensitive Data. Thi... | 2026-09-03 |
| CVE-2026-85304 | medium | 5.3 | No | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiti... | 2026-09-03 |
| CVE-2026-85303 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc. Booking and Rental Man... | 2026-09-03 |
| CVE-2026-84849 | medium | 6.5 | No | Unauthenticated Bypass Vulnerability in Pre-Orders for WooCommerce <= 2.3 versions. | 2026-09-03 |
| CVE-2026-84836 | high | 7.1 | No | Subscriber Insecure Direct Object References (IDOR) in WC Ukraine Shipping <= 1.22.3 versions. | 2026-09-03 |
| CVE-2026-84814 | critical | 9.8 | No | Subscriber Privilege Escalation in Bricksforge <= 3.1.8.8 versions. | 2026-09-03 |
| CVE-2026-84779 | high | 8.1 | No | Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. | 2026-09-03 |
| CVE-2026-84777 | high | 7.4 | No | Unauthenticated Broken Authentication in Really Simple SSL <= 9.8.0 versions. | 2026-09-03 |
| CVE-2026-84773 | high | 7.2 | No | Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions. | 2026-09-03 |