Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-51765 | critical | 9.8 | No | Incorrect access control in the recvIndirectMeshInfo function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to inser... | 2026-09-02 |
| CVE-2026-18550 | critical | 9.8 | No | The Nokri - Job Board WordPress Theme for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and in... | 2026-09-02 |
| CVE-2026-19806 | high | 8.8 | No | The Support Genix – Helpdesk, AI Chatbot, Knowledge Base & Customer Support Ticketing System plugin for WordPress is vulnerable to Authentic... | 2026-09-02 |
| CVE-2026-16787 | medium | 6.4 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dslc_custom_field'... | 2026-09-02 |
| CVE-2026-51768 | high | 7.5 | No | Incorrect access control in the setElinkQosConfig function of TOTOLINK T6 4.1.5cu.748_B20211015 allows unauthenticated attackers to modify p... | 2026-09-02 |
| CVE-2026-84118 | medium | 5.4 | No | Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunder... | 2026-09-02 |
| CVE-2026-84119 | critical | 9.6 | No | Sandbox escape due to use-after-free in the DOM: Navigation component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Fire... | 2026-09-02 |
| CVE-2026-84120 | medium | 5.4 | No | Use-after-free in the Audio/Video component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefox ESR 140.15, Firefox ES... | 2026-09-02 |
| CVE-2026-84121 | critical | 9.6 | No | Sandbox escape due to use-after-free in the DOM: Security component. This vulnerability was fixed in Firefox 155, Firefox ESR 115.40, Firefo... | 2026-09-02 |
| CVE-2026-73700 | critical | 9.0 | No | A vulnerability in the web-based management interface of HPE Networking Fabric Composer could allow an authenticated low privilege operator... | 2026-09-02 |
| CVE-2026-73701 | critical | 9.0 | No | An unauthenticated remote code execution vulnerability exists in the underlying operating system of HPE Networking Fabric Composer and could... | 2026-09-02 |
| CVE-2026-73710 | high | 8.2 | No | Vulnerabilities in an API endpoint of HPE Networking Fabric Composer could allow an unauthenticated remote attacker to conduct a denial of s... | 2026-09-02 |
| CVE-2026-84806 | medium | 5.4 | No | Kimai before 2.63.0 contains an improper authorization vulnerability in team access endpoints that allows authenticated users with team edit... | 2026-09-02 |
| CVE-2026-84801 | high | 8.8 | No | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with adm... | 2026-09-02 |
| CVE-2026-84798 | high | 7.1 | No | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(... | 2026-09-02 |
| CVE-2026-84796 | high | 8.8 | No | Craft CMS versions before 5.10.11 contain a site scope bypass vulnerability in GraphQL entry mutation resolvers that fail to validate siteId... | 2026-09-02 |
| CVE-2026-84770 | high | 8.8 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Mang Board WP <= 2.3.8 versions. | 2026-09-02 |
| CVE-2026-84431 | medium | 4.4 | No | A vulnerability was detected in AirAsia MOVE App up to 12.47.1 on Android. This issue affects the function com.airasia.core.utils.RealPathUt... | 2026-09-02 |
| CVE-2026-84289 | medium | 4.3 | No | A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mc... | 2026-09-02 |
| CVE-2026-84288 | medium | 4.3 | No | A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_ad... | 2026-09-02 |