Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91356 | medium | 4.2 | No | Vulnerability in the PeopleSoft Enterprise HCM Global Payroll Switzerland product of Oracle PeopleSoft (component: Global Payroll for Switze... | 2026-10-28 |
| CVE-2026-91338 | high | 7.1 | No | Vulnerability in the iSupport product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected are... | 2026-10-28 |
| CVE-2026-91337 | high | 7.4 | No | Vulnerability in the iProcurement product of Oracle E-Business Suite (component: Internal operations). Supported versions that are affected... | 2026-10-28 |
| CVE-2026-91335 | low | 2.6 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: AWT). S... | 2026-10-28 |
| CVE-2026-91334 | low | 3.7 | No | Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO... | 2026-10-28 |
| CVE-2026-91333 | low | 3.7 | No | Vulnerability in Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 21.0.12.1, 25.0.4.1 and 27.... | 2026-10-28 |
| CVE-2026-91331 | low | 3.8 | No | Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects... | 2026-10-28 |
| CVE-2026-39795 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in brewlabs SendPress Newsletters sendpre... | 2026-10-28 |
| CVE-2026-83500 | medium | 6.1 | No | Url redirection to untrusted site ('open redirect') in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a... | 2026-10-28 |
| CVE-2026-115281 | medium | 6.8 | No | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it... | 2026-10-28 |
| CVE-2026-115223 | medium | 4.9 | No | The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl... | 2026-10-28 |
| CVE-2026-115255 | medium | 5.3 | No | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthentica... | 2026-10-28 |
| CVE-2026-115225 | medium | 5.8 | No | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the... | 2026-10-28 |
| CVE-2026-115224 | medium | 4.1 | No | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category... | 2026-10-28 |
| CVE-2026-114491 | medium | 5.3 | No | pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attacker... | 2026-10-28 |
| CVE-2026-114265 | medium | 6.3 | No | A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file r... | 2026-10-28 |
| CVE-2026-114262 | high | 7.3 | No | A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the fil... | 2026-10-28 |
| CVE-2026-114133 | medium | 5.4 | No | Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe... | 2026-10-28 |
| CVE-2026-114129 | medium | 6.2 | No | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, F... | 2026-10-28 |
| CVE-2026-114125 | not reported | — | No | Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and... | 2026-10-28 |