Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-118101 | medium | 5.3 | No | The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowi... | 2026-10-30 |
| CVE-2026-118100 | medium | 5.3 | No | The BuddyForms WordPress plugin before 2.10.3 does not check that the requester is allowed to manage a form before exporting its configurati... | 2026-10-30 |
| CVE-2026-118072 | medium | 5.4 | No | The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before let... | 2026-10-30 |
| CVE-2026-118071 | medium | 6.8 | No | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the... | 2026-10-30 |
| CVE-2026-117572 | medium | 4.1 | No | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape a parameter before using it in a SQL... | 2026-10-30 |
| CVE-2026-117571 | high | 8.8 | No | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data derived from public vis... | 2026-10-30 |
| CVE-2026-115277 | medium | 4.7 | No | The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML att... | 2026-10-30 |
| CVE-2026-114444 | medium | 4.4 | No | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not restrict its File System Watcher fi... | 2026-10-30 |
| CVE-2026-114443 | high | 7.5 | No | The Security Plugin, Firewall & Malware Scanner with Auto Removal WordPress plugin before 2.191 does not verify the account password before... | 2026-10-30 |
| CVE-2026-114422 | high | 7.5 | No | The Enable Media Replace WordPress plugin before 4.2.3 does not restrict the classes allowed when deserializing stored metadata during its m... | 2026-10-30 |
| CVE-2026-63914 | high | 7.3 | No | In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrm_send_migrate(... | 2026-10-30 |
| CVE-2026-82104 | not reported | — | No | In Teltonika Networks RUTOS devices running versions from 7.22 through 7.24.2 and TSWOS devices running versions 1.9 through 1.10, a vulnera... | 2026-10-30 |
| CVE-2026-63915 | high | 8.8 | No | In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfc_hci_re... | 2026-10-30 |
| CVE-2026-63916 | high | 8.8 | No | In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacom_hid_set_device_mode() wacom_hid_set... | 2026-10-30 |
| CVE-2026-105924 | not reported | — | No | A NULL pointer dereference vulnerability in the Qt QCborValue to JSON conversion of the Qt Core module. | 2026-10-30 |
| CVE-2026-59388 | medium | 6.5 | No | Cloud Controller (CAPI) leaks sensitive data into audit logs in multiple instances: custom buildpack credentials are exposed in audit events... | 2026-10-30 |
| CVE-2026-59386 | medium | 6.5 | No | A SpaceSupporter could improperly modify an application's start command and buildpack—actions requiring SpaceDeveloper privileges. This priv... | 2026-10-30 |
| CVE-2026-59385 | low | 2.7 | No | A user with SpaceDeveloper privileges could modify the URL of a space-scoped broker without altering its credentials, enabling extraction of... | 2026-10-30 |
| CVE-2026-119317 | medium | 6.5 | No | On Linux, an authenticated, low-privileged Nessus user with scan-creation rights could read arbitrary text files on the scanner host with th... | 2026-10-30 |
| CVE-2026-6877 | not reported | — | No | ServiceNow has addressed a domain separation bypass security issue that was identified in the ServiceNow SR – CSM – Task Plan Templates Stor... | 2026-10-30 |