Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-13747 | medium | 6.5 | No | The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4 This is due to the p... | 2026-10-30 |
| CVE-2026-116552 | medium | 4.7 | No | The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header... | 2026-10-30 |
| CVE-2026-110533 | medium | 6.4 | No | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos[_fv_player_user_v... | 2026-10-30 |
| CVE-2026-107630 | high | 7.5 | No | The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to authorization bypass in all... | 2026-10-30 |
| CVE-2026-102905 | medium | 6.5 | No | The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, an... | 2026-10-30 |
| CVE-2026-9536 | high | 7.5 | No | A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk (version(s): 9.6.1). A... | 2026-10-30 |
| CVE-2026-9535 | high | 8.2 | No | A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk (version(s): 9.6.1). A specially crafted ch... | 2026-10-30 |
| CVE-2026-93680 | critical | 9.8 | No | IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper authentication. | 2026-10-30 |
| CVE-2026-94423 | critical | 9.1 | No | Net::LibSSH versions before 0.004 for Perl authenticate to an unverified server because connect never checks the host key against known_host... | 2026-10-30 |
| CVE-2026-93291 | critical | 9.4 | No | Omni C20 lacks proper certificate validation which could allow an attacker to perform a man-in-the-middle attack which could allow them to e... | 2026-10-30 |
| CVE-2026-90872 | medium | 6.6 | No | Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software WS_FTP Server versions p... | 2026-10-30 |
| CVE-2026-93290 | medium | 5.5 | No | Omni C20 uses hard-coded credentials that could allow an attacker to monitor log files to obtain credentials to access information like mapp... | 2026-10-30 |
| CVE-2026-90871 | medium | 5.3 | No | Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Wi... | 2026-10-30 |
| CVE-2026-90870 | medium | 5.3 | No | A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to 2024.0.... | 2026-10-30 |
| CVE-2026-90869 | high | 7.5 | No | A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress Software WS_FTP Serve... | 2026-10-30 |
| CVE-2026-90868 | critical | 9.9 | No | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbi... | 2026-10-30 |
| CVE-2026-90867 | high | 8.1 | No | Improper access control in the Web Admin console of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could... | 2026-10-30 |
| CVE-2026-90866 | critical | 9.1 | No | A path traversal vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated... | 2026-10-30 |
| CVE-2026-90865 | critical | 9.0 | No | An OS command injection vulnerability in Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow arbi... | 2026-10-30 |
| CVE-2026-8824 | high | 7.5 | No | A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk (version(s): 9.6.1). A speciall... | 2026-10-30 |