Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54860 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Ozisti <= 1.1.10 versions. | 2026-10-30 |
| CVE-2026-54857 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Quirky <= 1.23 versions. | 2026-10-30 |
| CVE-2026-54856 | critical | 9.8 | No | Unauthenticated PHP Object Injection in RexCoin <= 1.2.6 versions. | 2026-10-30 |
| CVE-2026-54852 | medium | 5.3 | No | Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows Exploiting Incorrectly Co... | 2026-10-30 |
| CVE-2026-42701 | high | 7.2 | No | Shop manager PHP Object Injection in YayMail <= 4.4.6 versions. | 2026-10-30 |
| CVE-2026-42694 | medium | 4.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Themeum Kirki kirki allows Code Injection.Thi... | 2026-10-30 |
| CVE-2026-42691 | medium | 5.4 | No | Authorization Bypass Through User-Controlled Key vulnerability in EventPrime EventPrime eventprime-event-calendar-management allows Privileg... | 2026-10-30 |
| CVE-2026-27394 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | 2026-10-30 |
| CVE-2026-27063 | medium | 5.3 | No | Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly Configured Access Control Secu... | 2026-10-30 |
| CVE-2026-27062 | medium | 4.3 | No | Cross-Site Request Forgery (CSRF) vulnerability in WPFunnels Team WPFunnels wpfunnels allows Cross Site Request Forgery.This issue affects W... | 2026-10-30 |
| CVE-2026-21811 | low | 3.8 | No | HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets accessible in plaintext... | 2026-10-30 |
| CVE-2026-119979 | high | 8.8 | No | LM Studio before 0.4.22+1 contains a path traversal vulnerability in the model downloader's resolveDownloadRequest that allows attackers to... | 2026-10-30 |
| CVE-2026-119176 | medium | 6.4 | No | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versi... | 2026-10-30 |
| CVE-2026-119288 | high | 7.0 | No | Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, @zuke/core launches resolved Windows .cmd and .bat s... | 2026-10-30 |
| CVE-2026-119113 | medium | 6.4 | No | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc... | 2026-10-30 |
| CVE-2026-118992 | high | 8.4 | No | CallBackery versions before 0.62.0 for Perl allow OS command execution via sqlite3 shell commands in a restored configuration backup. resto... | 2026-10-30 |
| CVE-2026-119087 | medium | 4.3 | No | The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions u... | 2026-10-30 |
| CVE-2026-119059 | medium | 4.3 | No | The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the aj... | 2026-10-30 |
| CVE-2026-118635 | medium | 6.5 | No | The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to arbitrary shortc... | 2026-10-30 |
| CVE-2026-118634 | medium | 6.4 | No | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and... | 2026-10-30 |