Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115968 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affect... | 2026-10-28 |
| CVE-2026-116393 | high | 7.5 | No | Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Contr... | 2026-10-28 |
| CVE-2026-115612 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stor... | 2026-10-28 |
| CVE-2026-115596 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ec... | 2026-10-28 |
| CVE-2026-116610 | medium | 4.3 | No | The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capabi... | 2026-10-28 |
| CVE-2026-114094 | high | 8.8 | No | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attack... | 2026-10-28 |
| CVE-2026-114089 | high | 8.8 | No | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/aut... | 2026-10-28 |
| CVE-2026-114086 | medium | 5.3 | No | Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated at... | 2026-10-28 |
| CVE-2026-114084 | high | 7.7 | No | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags qu... | 2026-10-28 |
| CVE-2026-114081 | high | 7.7 | No | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates window-function names into g... | 2026-10-28 |
| CVE-2026-114079 | medium | 5.4 | No | Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust environment API keys to cancel... | 2026-10-28 |
| CVE-2026-114076 | medium | 5.4 | No | Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated tenants to make the webapp ser... | 2026-10-28 |
| CVE-2026-114074 | medium | 5.4 | No | Trigger.dev before 4.5.10 contains a server-side request forgery vulnerability that allows authenticated project members to bypass webhook S... | 2026-10-28 |
| CVE-2026-114071 | low | 3.1 | No | Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another membe... | 2026-10-28 |
| CVE-2026-114069 | high | 8.1 | No | Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET /api/v1/projects/:projectRef/envvars endpoint, which re... | 2026-10-28 |
| CVE-2026-114066 | high | 8.1 | No | Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment API keys to block ru... | 2026-10-28 |
| CVE-2026-114064 | medium | 5.5 | No | Snipe-IT before 8.7.0 contains a server-side request forgery vulnerability in the webhook testing feature that allows super-admin users to p... | 2026-10-28 |
| CVE-2026-114061 | medium | 4.7 | No | SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header val... | 2026-10-28 |
| CVE-2026-114059 | high | 7.5 | No | ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including read-only reader role hold... | 2026-10-28 |
| CVE-2026-114056 | medium | 4.3 | No | ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweig... | 2026-10-28 |