Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-105926 | not reported | — | No | The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and GetOrCr... | 2026-10-30 |
| CVE-2026-105894 | high | 8.8 | No | The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to Privilege Escalation... | 2026-10-30 |
| CVE-2026-105869 | not reported | — | No | Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The p... | 2026-10-30 |
| CVE-2026-104744 | high | 7.2 | No | The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all vers... | 2026-10-30 |
| CVE-2026-104739 | medium | 4.9 | No | The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient f... | 2026-10-30 |
| CVE-2026-105270 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in esaml_binding in dropbox esaml allows an unauthenticated attacker to e... | 2026-10-30 |
| CVE-2026-104948 | not reported | — | No | WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the buil... | 2026-10-30 |
| CVE-2026-104947 | not reported | — | No | WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backen... | 2026-10-30 |
| CVE-2026-104623 | medium | 6.3 | No | A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE Rancher Manager 2.15.... | 2026-10-30 |
| CVE-2026-104592 | medium | 6.5 | No | libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.c. This allows a remote attacker... | 2026-10-30 |
| CVE-2026-102918 | medium | 6.4 | No | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the m... | 2026-10-30 |
| CVE-2026-101364 | medium | 5.4 | No | Vulnerability in Oracle REST Data Services (component: Database Actions). Supported versions that are affected are 24.2.0-26.1.0. Easily exp... | 2026-10-30 |
| CVE-2026-101363 | medium | 5.3 | No | Vulnerability in Oracle REST Data Services (component: Graph QL). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable... | 2026-10-30 |
| CVE-2026-101362 | medium | 6.9 | No | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit v... | 2026-10-30 |
| CVE-2026-101361 | medium | 4.2 | No | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Difficult to exploit v... | 2026-10-30 |
| CVE-2026-101360 | medium | 5.4 | No | Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0. Easily exploitable vul... | 2026-10-30 |
| CVE-2025-6017 | medium | 5.5 | No | A flaw was found in Red Hat Advanced Cluster Management through versions 2.10, before 2.10.7, 2.11, before 2.11.4, and 2.12, before 2.12.4.... | 2026-10-30 |
| CVE-2025-57848 | medium | 6.4 | No | A container privilege escalation flaw was found in certain Container-native Virtualization images. This issue stems from the /etc/passwd fil... | 2026-10-30 |
| CVE-2025-11537 | medium | 5.0 | No | A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' patt... | 2026-10-30 |
| CVE-2025-13204 | critical | 9.8 | No | npm package `expr-eval` is vulnerable to Prototype Pollution. An attacker with access to express eval interface can use JavaScript prototype... | 2026-10-30 |