# CVEs published 2026-09-05

131 CVEs were published on September 5, 2026: 18 critical, 38 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2026-86151](https://cve.now/CVE-2026-86151.md): Tenda CP3 Network Configuration Management system.c sub\_2F77E8 os command injection (CVSS 9.4, Tenda CP3)
- [CVE-2026-86150](https://cve.now/CVE-2026-86150.md): Tenda CP3 hostapd hard-coded credentials (CVSS 5.1, Tenda CP3)
- [CVE-2026-86149](https://cve.now/CVE-2026-86149.md): Tenda CP3 NetCheckPing.cpp os command injection (CVSS 9.4, Tenda CP3)
- [CVE-2026-86148](https://cve.now/CVE-2026-86148.md): Tenda CP3 Kylin system.c SystemAsh os command injection (CVSS 9.4, Tenda CP3)
- [CVE-2026-86060](https://cve.now/CVE-2026-86060.md): SSH session privilege manipulation via a crafted username in Mikrotik RouterOS (CVSS 9.2, KEV, Mikrotik RouterOS)
- [CVE-2026-67281](https://cve.now/CVE-2026-67281.md): Unauthenticated file read in Mikrotik RouterOS (CVSS 8.7, Mikrotik RouterOS)
- [CVE-2026-67279](https://cve.now/CVE-2026-67279.md): SSH Pre-Authentication Rekey State Bypass in MikroTik RouterOS (CVSS 6.9, KEV, Mikrotik RouterOS)
- [CVE-2026-67278](https://cve.now/CVE-2026-67278.md): TLS server impersonation possible in Mikrotik RouterOS (CVSS 6.3, Mikrotik RouterOS)
- [CVE-2026-67277](https://cve.now/CVE-2026-67277.md): Kernel memory disclosure and denial of service in MikroTik RouterOS btest service (CVSS 8.8, KEV, Mikrotik RouterOS)
- [CVE-2026-67276](https://cve.now/CVE-2026-67276.md): SSH user impersonation possible in Mikrotik RouterOS (CVSS 9.2, Mikrotik RouterOS)
- [CVE-2026-86206](https://cve.now/CVE-2026-86206.md): Access control filter bypass allows unauthorised access to APIs (CVSS 6.9, N-able N-central)
- [CVE-2026-86207](https://cve.now/CVE-2026-86207.md): Authentication bypass leads to unauthorised access to N-central (CVSS 7.7, N-able N-central)
- [CVE-2026-18238](https://cve.now/CVE-2026-18238.md): OOBR in rpcap client in libpcap before 1.10.7 (CVSS 5.0, The Tcpdump Group libpcap)
- [CVE-2026-18313](https://cve.now/CVE-2026-18313.md): rpcapd memory leak in libpcap before 1.10.7 (CVSS 4.3, The Tcpdump Group libpcap)
- [CVE-2026-6554](https://cve.now/CVE-2026-6554.md): infinte loop in libpcap before 1.10.7 (CVSS 7.5, The Tcpdump Group libpcap)
- [CVE-2026-6244](https://cve.now/CVE-2026-6244.md): division by zero in libpcap before 1.10.7 (CVSS 5.5, The Tcpdump Group libpcap)
- [CVE-2026-31911](https://cve.now/CVE-2026-31911.md): abort() in libpcap before 1.10.7 on an invalid BPF opcode (CVSS 5.5, The Tcpdump Group libpcap)
- [CVE-2026-31912](https://cve.now/CVE-2026-31912.md): OOBR in libpcap before 1.10.7 (CVSS 5.5, The Tcpdump Group libpcap)
- [CVE-2026-0799](https://cve.now/CVE-2026-0799.md): OOBR and OOBW in libpcap before 1.10.7 (CVSS 8.7, The Tcpdump Group libpcap)
- [CVE-2026-82752](https://cve.now/CVE-2026-82752.md): Ash string length constraints count graphemes, so a combining-mark string of any size passes max\_length (CVSS 5.9, ash-project ash)
- [CVE-2026-86197](https://cve.now/CVE-2026-86197.md): Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox (CVSS 5.1, getgrav grav · getgrav/grav)
- [CVE-2026-86196](https://cve.now/CVE-2026-86196.md): Grav API Plugin before 1.0.20 Authentication Bypass via Host Header (CVSS 8.7, getgrav grav-plugin-api)
- [CVE-2026-86195](https://cve.now/CVE-2026-86195.md): grav-plugin-api 1.0.0 through 1.0.19 Privilege Escalation via Dot-Keyed Super Flag (CVSS 8.7, getgrav grav-plugin-api)
- [CVE-2026-86194](https://cve.now/CVE-2026-86194.md): Grav Form Plugin before 9.1.22 Cross-Page Form Execution (CVSS 6.9, getgrav grav-plugin-form)
- [CVE-2026-86193](https://cve.now/CVE-2026-86193.md): Grav API Plugin Authentication Bypass via Group-Inherited Super (CVSS 8.7, getgrav grav-plugin-api)
- [CVE-2026-86192](https://cve.now/CVE-2026-86192.md): SiYuan before v3.8.2 Information Disclosure via Attribute-View (CVSS 7.1, siyuan-note siyuan)
- [CVE-2026-86191](https://cve.now/CVE-2026-86191.md): SiYuan before v3.8.2 Private Attribute View Key Enumeration (CVSS 5.3, siyuan-note siyuan)
- [CVE-2026-86190](https://cve.now/CVE-2026-86190.md): WWBN AVideo Broken Access Control via videoViewsInfo hash Parameter (CVSS 9.3, WWBN AVideo)
- [CVE-2026-86189](https://cve.now/CVE-2026-86189.md): WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php (CVSS 9.3, WWBN AVideo)
- [CVE-2026-86188](https://cve.now/CVE-2026-86188.md): AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting (CVSS 6.9, WWBN AVideo)
- [CVE-2026-86187](https://cve.now/CVE-2026-86187.md): WWBN AVideo Weak PRNG Password Generation via External Login (CVSS 7.4, WWBN AVideo)
- [CVE-2026-86186](https://cve.now/CVE-2026-86186.md): AVideo API Rate Limit Bypass via Bot User-Agent Header (CVSS 6.3, WWBN AVideo)
- [CVE-2026-86185](https://cve.now/CVE-2026-86185.md): Bilibili Desktop through 1.18.0 Remote Code Execution via TLS Verification Bypass (CVSS 8.0, Bilibili Desktop)
- [CVE-2026-86184](https://cve.now/CVE-2026-86184.md): Lara Dashboard before 1.3.0 Missing Authentication in screenshot-login Route (CVSS 9.3, laradashboard)
- [CVE-2025-15647](https://cve.now/CVE-2025-15647.md): CDT before 1.4.5 Out-of-Bounds Read via opposedVertexInd (CVSS 6.8, artem-ogre CDT)
- [CVE-2025-15614](https://cve.now/CVE-2025-15614.md): ugrep before 7.6.0 Heap Buffer Over-read via .Z decompression (CVSS 4.8, Genivia ugrep)
- [CVE-2025-9049](https://cve.now/CVE-2025-9049.md): Nokri – Job Board WordPress Theme \<= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover (CVSS 8.8, scriptsbundle Nokri – Job Board WordPress Theme)
- [CVE-2026-15550](https://cve.now/CVE-2026-15550.md): Ninja Forms - Save Progress \<= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin\_init Hook (CVSS 4.3, Saturday Drive Ninja Forms - Save Progress)
- [CVE-2026-10196](https://cve.now/CVE-2026-10196.md): Mail Mint \<= 1.31.0 - Unauthenticated PHP Object Injection in Arbitrary Form Fields (CVSS 9.8, getwpfunnels Mail Mint – Email Marketing, Newsletter, Email…)
- [CVE-2026-12843](https://cve.now/CVE-2026-12843.md): LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint (CVSS 5.4, StellarWP LearnDash LMS)
- [CVE-2026-86178](https://cve.now/CVE-2026-86178.md): Pixelfed through 0.12.9 Unauthorized Story Access via API (CVSS 5.4, pixelfed)
- [CVE-2026-86177](https://cve.now/CVE-2026-86177.md): Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks (CVSS 8.7, pterodactyl panel)
- [CVE-2026-86176](https://cve.now/CVE-2026-86176.md): NetBox through 4.7.0 Information Disclosure via REST and GraphQL APIs (CVSS 4.3, netbox-community netbox)
- [CVE-2026-86175](https://cve.now/CVE-2026-86175.md): NetBox through 4.7.0 Credential Disclosure via REST and GraphQL APIs (CVSS 6.5, netbox-community netbox)
- [CVE-2026-86174](https://cve.now/CVE-2026-86174.md): Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board (CVSS 5.3, makeplane plane)
- [CVE-2026-86173](https://cve.now/CVE-2026-86173.md): MindsDB through 26.1.0 Unauthenticated SSRF via Web Crawler (CVSS 8.7, mindsdb)
- [CVE-2026-86169](https://cve.now/CVE-2026-86169.md): Axolotl before 0.19.0 Remote Code Execution via Multipack Patching (CVSS 8.7, axolotl-ai-cloud axolotl)
- [CVE-2026-86124](https://cve.now/CVE-2026-86124.md): AutoAgent Unauthenticated Remote Code Execution via the Sandbox TCP Command Server (CVSS 9.3, HKUDS AutoAgent)
- [CVE-2026-86123](https://cve.now/CVE-2026-86123.md): SQL Chat Unauthenticated Database-Connection Proxy in the /api/connection Endpoints (CVSS 9.4, sqlchat)
- [CVE-2026-86122](https://cve.now/CVE-2026-86122.md): Rowboat through 0.9.1 Server-Side Request Forgery via Custom MCP Server (CVSS 5.3, rowboatlabs rowboat)
- [CVE-2026-86121](https://cve.now/CVE-2026-86121.md): Cua computer-server before 0.3.42 Unauthenticated RCE via Desktop Control (CVSS 9.3, trycua cua-computer-server)
- [CVE-2026-86120](https://cve.now/CVE-2026-86120.md): APITable through 1.13.0-beta.1 Fail-Open Authorization in the Fusion API Node Permission Guard (CVSS 5.3, apitable)
- [CVE-2026-86119](https://cve.now/CVE-2026-86119.md): Webstudio through 0.296.0 SSRF via /cgi proxy routes (CVSS 9.2, webstudio-is webstudio)
- [CVE-2026-86118](https://cve.now/CVE-2026-86118.md): gonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint (CVSS 5.3, sentriz gonic)
- [CVE-2026-86117](https://cve.now/CVE-2026-86117.md): Coolify through 4.3.17 OAuth Account Takeover via Unverified Email Matching (CVSS 9.2, coollabsio coolify)
- [CVE-2026-86116](https://cve.now/CVE-2026-86116.md): Metabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API (CVSS 7.1, metabase)
- [CVE-2026-86115](https://cve.now/CVE-2026-86115.md): Sim before 0.8.14 Confused Deputy in Tool URL Routing Mints an Internal Token for a User-Supplied /api/ Path (CVSS 5.3, simstudioai sim)
- [CVE-2026-86114](https://cve.now/CVE-2026-86114.md): Arcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints (CVSS 7.1, getarcaneapp arcane)
- [CVE-2026-86113](https://cve.now/CVE-2026-86113.md): BookWyrm through 0.9.1 Insecure Direct Object Reference in edit-readthrough Allows Tampering with Other Users' Reading Records (CVSS 7.1, bookwyrm-social bookwyrm)
- [CVE-2026-86112](https://cve.now/CVE-2026-86112.md): BookWyrm through 0.9.1 Missing Authorization on the Favorite and Unfavorite Endpoints (CVSS 5.3, bookwyrm-social bookwyrm)
- [CVE-2026-86111](https://cve.now/CVE-2026-86111.md): BookWyrm through 0.9.1 Insecure Direct Object Reference in EditStatus Exposes Followers-Only and Direct Statuses (CVSS 7.1, bookwyrm-social bookwyrm)
- [CVE-2024-11080](https://cve.now/CVE-2024-11080.md): Post Grid and Gutenberg Blocks – ComboBlocks 2.2.85 - 2.3.32 - Unauthenticated Hook Injection (CVSS 9.8, pickplugins Post Grid)
- [CVE-2026-76573](https://cve.now/CVE-2026-76573.md): Pods \<= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not\_found' Shortcode Attribute (CVSS 6.4, sc0ttkclark Pods – Custom Content Types and Fields)
- [CVE-2026-81543](https://cve.now/CVE-2026-81543.md): Abandoned Cart Pro for WooCommerce \<= 10.7.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, Tyche Softwares Abandoned Cart Pro for WooCommerce)
- [CVE-2026-83625](https://cve.now/CVE-2026-83625.md): Contact Form by Supsystic \<= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header (CVSS 7.2, supsysticcom Contact Form by Supsystic)
- [CVE-2026-75018](https://cve.now/CVE-2026-75018.md): Custom Contact Forms \<= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields\[\].ID' / 'choices\[\].ID' Parameters (CVSS 4.3, outlawgt Custom Contact Forms)
- [CVE-2026-85414](https://cve.now/CVE-2026-85414.md): Gallery : FooGallery \<= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom\_settings' Shortcode Attribute (CVSS 6.4, fooplugins Gallery : FooGallery)
- [CVE-2026-75586](https://cve.now/CVE-2026-75586.md): Unlimited Elements For Elementor \<= 2.0.17 - Reflected Cross-Site Scripting via 'formData\[id\]' Parameter (CVSS 6.1, unitecms Unlimited Elements For Elementor)
- [CVE-2026-4361](https://cve.now/CVE-2026-4361.md): Divi \<= 4.27.6 - Authenticated (Contributor+) Server-Side Request Forgery via 'image\_src' Parameter (CVSS 5.0, Elegant Themes Divi)
- [CVE-2026-3853](https://cve.now/CVE-2026-3853.md): Divi \<= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image\_src' Shortcode Parameter (CVSS 6.4, Elegant Themes Divi)
- [CVE-2026-15984](https://cve.now/CVE-2026-15984.md): QuickCal \<= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters (CVSS 7.2, Themovation QuickCal)
- [CVE-2026-18406](https://cve.now/CVE-2026-18406.md): SureForms \<= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Text Field Entity-Encoded Payload (CVSS 7.2, brainstormforce SureForms – Contact Form Builder, AI Forms,…)
- [CVE-2026-19887](https://cve.now/CVE-2026-19887.md): Welcart e-Commerce \<= 2.12.1 - Unauthenticated Arbitrary File Deletion via PHP Object Injection via 'reserve' Checkout Parameter and 'option' EDY Callback (CVSS 8.8, uscnanbu Welcart e-Commerce)
- [CVE-2026-78438](https://cve.now/CVE-2026-78438.md): W3 Total Cache \<= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator (CVSS 7.2, boldgrid W3 Total Cache)
- [CVE-2026-14975](https://cve.now/CVE-2026-14975.md): WP File Download \<= 6.3.8 - Authenticated (Subscriber+) Arbitrary File Read via Path Traversal in 'remoteurl' Parameter (CVSS 6.5, JoomUnited WP File Download)
- [CVE-2026-19769](https://cve.now/CVE-2026-19769.md): Ninja Forms \<= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key (CVSS 7.2, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2026-16649](https://cve.now/CVE-2026-16649.md): Gravity Forms \<= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value (CVSS 7.2, Gravity Forms)
- [CVE-2026-77830](https://cve.now/CVE-2026-77830.md): Spam protection, Honeypot, Anti-Spam by CleanTalk \<= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder (CVSS 7.2, Spam protection, Honeypot, Anti-Spam by CleanTalk)
- [CVE-2026-18843](https://cve.now/CVE-2026-18843.md): Beaver Builder Plugin (Pro Version) \<= 2.11.0.1 - Reflected Cross-Site Scripting via 'no\_results\_message' node\_preview Parameter (CVSS 6.1, The Beaver Builder Team Beaver Builder Plugin)
- [CVE-2026-84937](https://cve.now/CVE-2026-84937.md): YT Player \< 2.1.0 - Contributor+ SQLi via ytp\_ajax (CVSS 6.8, Video Player for YouTube)
- [CVE-2026-84936](https://cve.now/CVE-2026-84936.md): EmbedPress 4.6.0 - 4.6.3 - Unauthenticated Google Reviews API Quota Consumption and Database Bloat (CVSS 5.3, EmbedPress)
- [CVE-2026-84935](https://cve.now/CVE-2026-84935.md): HT Menu \< 1.2.7 - Subscriber+ Stored XSS via Menu Settings (CVSS 8.0, HT Menu)
- [CVE-2026-84934](https://cve.now/CVE-2026-84934.md): JCH Optimize \< 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override (CVSS 8.0, JCH Optimize)
- [CVE-2026-84931](https://cve.now/CVE-2026-84931.md): Joli Table Of Contents \< 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute (CVSS 6.8, Joli Table Of Contents)
- [CVE-2026-84930](https://cve.now/CVE-2026-84930.md): CatFolders Document Gallery \< 2.0.7 - Author+ Stored XSS via titleTag Block Attribute (CVSS 6.8, CatFolders Document Gallery & PDF Library)
- [CVE-2026-84927](https://cve.now/CVE-2026-84927.md): EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification (CVSS 2.7, EmbedPress)
- [CVE-2026-84926](https://cve.now/CVE-2026-84926.md): EmbedPress 4.6.0 - 4.6.3 - Contributor+ Administrator Email Disclosure via Google Reviews REST Route (CVSS 2.7, EmbedPress)
- [CVE-2026-84901](https://cve.now/CVE-2026-84901.md): Eventin \< 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization (CVSS 4.9, Eventin)
- [CVE-2026-84899](https://cve.now/CVE-2026-84899.md): VikWidgetsLoader \< 1.12.0 - Contributor+ Stored XSS via Gutenberg Block class\_suffix (CVSS 6.8, VikWidgetsLoader)
- [CVE-2026-84898](https://cve.now/CVE-2026-84898.md): Eventin \< 4.1.21 - Contributor+ LFI via Event Layout Meta (CVSS 6.6, Eventin)
- [CVE-2026-84896](https://cve.now/CVE-2026-84896.md): King Addons for Elementor \< 51.1.77 - Contributor+ Stored XSS via Magazine Grid Widget (CVSS 6.8, King Addons for Elementor)
- [CVE-2026-84745](https://cve.now/CVE-2026-84745.md): The Events Calendar &lt; 6.17.3.1 - Contributor+ Non-Public Event, Venue and Organizer Content Disclosure via REST API (CVSS 2.7, The Events Calendar)
- [CVE-2026-84225](https://cve.now/CVE-2026-84225.md): Kirki 6.0.0 - 6.2.5 - Authenticated Collaboration Comment Status Modification via IDOR (CVSS 2.2, Kirki)
- [CVE-2026-84221](https://cve.now/CVE-2026-84221.md): Kirki 6.0.0 - 6.2.5 - Editor+ SQLi via Content Manager Field ID (CVSS 6.8, Kirki)
- [CVE-2026-84022](https://cve.now/CVE-2026-84022.md): Bold Page Builder \< 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes (CVSS 6.8, Bold Page Builder)
- [CVE-2026-84021](https://cve.now/CVE-2026-84021.md): Bold Page Builder \< 5.9.8 - Contributor+ Stored XSS via bt\_bb\_button/bt\_bb\_headline/bt\_bb\_icon URL (CVSS 6.8, Bold Page Builder)
- [CVE-2026-83544](https://cve.now/CVE-2026-83544.md): Greenshift \< 13.2.0 - Contributor+ Stored XSS via Block Animation customProps Attribute (CVSS 6.8, Greenshift)
- [CVE-2026-83543](https://cve.now/CVE-2026-83543.md): Greenshift \< 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint (CVSS 4.1, Greenshift)
- [CVE-2026-82846](https://cve.now/CVE-2026-82846.md): Masteriyo LMS 1.18.0 - 2.3.3 - Instructor+ Stored XSS via Course Custom Fields (CVSS 6.8, Masteriyo LMS)
- [CVE-2026-82304](https://cve.now/CVE-2026-82304.md): Music Store – WordPress eCommerce \< 1.4.5 - Unauthenticated SQLi via paypal-data Handler (CVSS 8.6, Music Store)
- [CVE-2026-81424](https://cve.now/CVE-2026-81424.md): Accept Stripe Payments \< 2.1.4 - Unauthenticated Product Substitution via IDOR (CVSS 5.3, Accept Stripe Payments)
- [CVE-2026-81423](https://cve.now/CVE-2026-81423.md): Accept Stripe Payments \< 2.1.4 - Open Redirect via IPN Handler (CVSS 4.3, Accept Stripe Payments)
- [CVE-2026-81404](https://cve.now/CVE-2026-81404.md): IPGP Visitors Origin \< 1.6 - Reflected XSS (CVSS 7.1, IPGP Visitors Origin)
- [CVE-2026-81348](https://cve.now/CVE-2026-81348.md): My Private Site \< 4.2.3 - Unauthenticated Sensitive Information Exposure via RSS Feeds and Sitemap (CVSS 3.7, My Private Site)
- [CVE-2026-78362](https://cve.now/CVE-2026-78362.md): SEO Flow by LupsOnline 3.0.0 - 3.0.2 - Unauthenticated Privilege Escalation via API Key Authentication (CVSS 9.8, SEO Flow by LupsOnline)
- [CVE-2026-78150](https://cve.now/CVE-2026-78150.md): Post Carousel 4.0.0 - 4.0.7 - Contributor+ Private and Protected Post Content Disclosure via saved-templates-duplicate IDOR (CVSS 2.7, Smart Post)
- [CVE-2026-78149](https://cve.now/CVE-2026-78149.md): Post Carousel 4.0.0 - 4.0.7 - Unauthenticated Password-Protected Post Content and post\_password Disclosure via sp\_handle\_post\_id (CVSS 5.3, Smart Post)
- [CVE-2026-77826](https://cve.now/CVE-2026-77826.md): RegistrationMagic 5.0.1.8 - 6.0.9.8 - Unauthenticated Authentication Bypass via Missing Facebook Token Audience Validation (CVSS 8.8, RegistrationMagic)
- [CVE-2026-19861](https://cve.now/CVE-2026-19861.md): JetFormBuilder \< 3.6.5.2 - Unauthenticated Stored XSS via WYSIWYG Field in Notification Emails (CVSS 4.7, JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-19858](https://cve.now/CVE-2026-19858.md): JetFormBuilder \< 3.6.5.2 - Unauthenticated Password Hash and Arbitrary Metadata Disclosure via Dynamic Preset (CVSS 7.5, JetFormBuilder — Dynamic Blocks Form Builder)
- [CVE-2026-15247](https://cve.now/CVE-2026-15247.md): Search Atlas SEO \< 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion (CVSS 5.4, Search Atlas SEO)
- [CVE-2025-15694](https://cve.now/CVE-2025-15694.md): Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS (CVSS 3.5, Joli Table Of Contents)
- [CVE-2025-15693](https://cve.now/CVE-2025-15693.md): JCH Optimize 4.2.1 - 5.0.0 - Admin+ Path Traversal (CVSS 2.7, JCH Optimize)
- [CVE-2026-77263](https://cve.now/CVE-2026-77263.md): iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more \<= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content (CVSS 7.2, iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…)
- [CVE-2026-18404](https://cve.now/CVE-2026-18404.md): Social Chat \<= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent\_message' JSON Attribute in .qlwapp data-box (CVSS 6.4, quadlayers Social Chat – Click To Chat App Button)
- [CVE-2026-77233](https://cve.now/CVE-2026-77233.md): iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more \<= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite (CVSS 7.2, iubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…)
- [CVE-2025-14945](https://cve.now/CVE-2025-14945.md): Events Manager - Calendar, Bookings, Tickets, and more! \<= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes (CVSS 5.4, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2026-8625](https://cve.now/CVE-2026-8625.md): Dear Flipbook \<= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML (CVSS 6.4, dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, P…)
- [CVE-2026-83628](https://cve.now/CVE-2026-83628.md): Theme My Login \<= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage (CVSS 4.3, jfarthing84 Theme My Login)
- [CVE-2026-83627](https://cve.now/CVE-2026-83627.md): Hummingbird – Speed Optimization, Caching, Minify, Compress & CDN \<= 3.21.0 - Unauthenticated Remote Code Execution via Cookie Name in Page Cache Debug Log (CVSS 9.8, wpmudev Hummingbird Performance – Cache & Page Speed Optimi…)
- [CVE-2026-13447](https://cve.now/CVE-2026-13447.md): MStore API \<= 4.20.0 - Unauthenticated Authentication Bypass via 'id\_token' Parameter JWT Forgery (CVSS 9.8, inspireui MStore API – Create Native Android & iOS Apps On…)
- [CVE-2026-8623](https://cve.now/CVE-2026-8623.md): Dear Flipbook \<= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute (CVSS 6.4, dearhive DearFlip – PDF Flipbook, 3D Flipbook, PDF embed, P…)
- [CVE-2026-86145](https://cve.now/CVE-2026-86145.md): PCRE2 before 10.48 allows a pcre2\_dfa\_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching works (CVSS 8.2, PCRE2)
- [CVE-2026-86144](https://cve.now/CVE-2026-86144.md): In xinclude in libxml2 before 2.15.4, xmlXIncludeProcess and xmlXIncludeProcessTree do not propagate parseFlags. (CVSS 5.6, xmlsoft libxml2)
- [CVE-2026-86143](https://cve.now/CVE-2026-86143.md): In xmlIO in libxml2 before 2.15.4, an inconsistency in xmlOutputWriteCallback and xmlBufUse causes negative lengths to reach write callbacks (CVSS 6.9, xmlsoft libxml2)
- [CVE-2026-86142](https://cve.now/CVE-2026-86142.md): In libxml2 before 2.15.4, there is a heap-based buffer overflow in xmlXPtrEvalXPtrPart because of xmlXPtrEval xpointer length saturation. (CVSS 6.9, xmlsoft libxml2)
- [CVE-2026-86141](https://cve.now/CVE-2026-86141.md): xmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate (CVSS 2.9, xmlsoft libxml2)
- [CVE-2026-86140](https://cve.now/CVE-2026-86140.md): In libxml2 before 2.15.4, xmlSnprintfElements in valid.c has a strcat stack-based buffer overflow. (CVSS 8.0, xmlsoft libxml2)
- [CVE-2026-86139](https://cve.now/CVE-2026-86139.md): In libxml2 before 2.15.4, xmlURIEscapeStr in uri.c has an integer overflow. (CVSS 6.9, xmlsoft libxml2)
- [CVE-2026-86138](https://cve.now/CVE-2026-86138.md): In libxml2 before 2.15.4, xmlDictAddQString in dict.c has an integer overflow and resultant heap-based buffer overflow. (CVSS 6.9, xmlsoft libxml2)
- [CVE-2026-86137](https://cve.now/CVE-2026-86137.md): In libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp. (CVSS 2.9, xmlsoft libxml2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2026-09-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.