Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62131 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions. | 2026-10-30 |
| CVE-2026-62016 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Gamic <= 1.19 versions. | 2026-10-30 |
| CVE-2026-62015 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions. | 2026-10-30 |
| CVE-2026-62014 | critical | 9.8 | No | Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions. | 2026-10-30 |
| CVE-2026-62011 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions. | 2026-10-30 |
| CVE-2026-62010 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions. | 2026-10-30 |
| CVE-2026-62009 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions. | 2026-10-30 |
| CVE-2026-62005 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Muzicon <= 1.15 versions. | 2026-10-30 |
| CVE-2026-62004 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Motorix <= 1.11 versions. | 2026-10-30 |
| CVE-2026-62003 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Mission <= 1.22 versions. | 2026-10-30 |
| CVE-2026-61998 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Le Truffe <= 1.1.7 versions. | 2026-10-30 |
| CVE-2026-61997 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Legal Stone <= 1.2.11 versions. | 2026-10-30 |
| CVE-2026-61996 | high | 8.5 | No | Subscriber SQL Injection in MLS On The Fly <= 1.8.1.5 versions. | 2026-10-30 |
| CVE-2026-61992 | critical | 9.8 | No | Unauthenticated PHP Object Injection in GEO my WordPress <= 4.5.5.3 versions. | 2026-10-30 |
| CVE-2026-61991 | critical | 10.0 | No | Unauthenticated Remote Code Execution (RCE) in AjaxLoadMore Cache <= 3.1.1 versions. | 2026-10-30 |
| CVE-2026-61989 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | 2026-10-30 |
| CVE-2026-5461 | medium | 6.5 | No | The Forminator Forms plugin for WordPress is vulnerable to Limited File Deletion in all versions up to, and including, 1.55.0.2. This is due... | 2026-10-30 |
| CVE-2026-57207 | medium | 5.9 | No | NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http,... | 2026-10-30 |
| CVE-2026-54865 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | 2026-10-30 |
| CVE-2026-54864 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | 2026-10-30 |