Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118252 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses componen... | 2026-10-30 |
| CVE-2026-118248 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions p... | 2026-10-30 |
| CVE-2026-118244 | not reported | — | No | Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw mar... | 2026-10-30 |
| CVE-2026-118205 | high | 7.4 | No | The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Privilege Escalation in all... | 2026-10-30 |
| CVE-2026-118194 | medium | 6.5 | No | The Page and Post Restriction plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.6.1 This i... | 2026-10-30 |
| CVE-2026-118085 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. | 2026-10-30 |
| CVE-2026-118084 | medium | 6.5 | No | Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions. | 2026-10-30 |
| CVE-2026-118091 | medium | 5.3 | No | Missing Authorization vulnerability in WPFunnels Team WPFunnels wpfunnels allows Exploiting Incorrectly Configured Access Control Security L... | 2026-10-30 |
| CVE-2026-118083 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions. | 2026-10-30 |
| CVE-2026-118082 | high | 8.8 | No | Subscriber Privilege Escalation in Buddyboss Platform <= 3.5.0 versions. | 2026-10-30 |
| CVE-2026-118078 | high | 7.2 | No | Shop manager PHP Object Injection in Product Catalog Feed by PixelYourSite <= 3.1.4 versions. | 2026-10-30 |
| CVE-2026-118077 | high | 7.2 | No | Author PHP Object Injection in Sastra Essential Addons for Elementor <= 1.2.3 versions. | 2026-10-30 |
| CVE-2026-118074 | high | 7.2 | No | Shop manager PHP Object Injection in Finale Lite <= 2.21.0 versions. | 2026-10-30 |
| CVE-2026-118073 | high | 8.8 | No | Subscriber PHP Object Injection in News Kit Elementor Addons <= 1.5.0 versions. | 2026-10-30 |
| CVE-2026-116869 | high | 7.2 | No | Shop manager PHP Object Injection in myPOS Checkout <= 1.4.5 versions. | 2026-10-30 |
| CVE-2026-116866 | high | 8.8 | No | Contributor PHP Object Injection in Extra Fees Plugin for WooCommerce <= 4.4.0 versions. | 2026-10-30 |
| CVE-2026-116865 | high | 7.2 | No | Editor PHP Object Injection in Zippy <= 1.7.0 versions. | 2026-10-30 |
| CVE-2026-116864 | high | 7.2 | No | Author PHP Object Injection in WPCargo Track & Trace <= 8.0.5 versions. | 2026-10-30 |
| CVE-2026-116848 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovations The Plus Addons f... | 2026-10-30 |
| CVE-2026-116689 | medium | 5.9 | No | follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.2, the documented s... | 2026-10-30 |