CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-09-19 (6)

2026-09-19 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-09-19

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-61682 — 9.9 — kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.31.4 and 0.32.2, the kcp front-proxy does not remove inbound X-Remote-User, X-Remote-Group, or X…
  • CVE-2026-93839 — 9.8 — LightLLM through 1.2.0 contains an authentication bypass vulnerability in the /pd_register WebSocket endpoint that allows unauthenticated attackers to register arbitrary nodes by supplying crafted JSON without peer addre…
  • CVE-2026-84434 — 9.8 — The Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.1.0.4 via the upload_file function. This is due to a mismatch between the field validation pipeline an…
  • CVE-2026-86591 — 9.8 — The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbitrary WordPress options with arbitrary values, which could le…
  • CVE-2026-89274 — 9.1 — The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRM_Metadata::sanitize_metadata() recursively call…
  • CVE-2026-92229 — 9.1 — The The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.57.2. This is due to the software al…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.