Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109368 | medium | 6.5 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc... | 2026-10-19 |
| CVE-2026-108123 | high | 7.5 | No | The WP Booking System – Booking Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.... | 2026-10-19 |
| CVE-2026-107752 | medium | 4.9 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wp_usces_order_old (JSON fields searchSql / sear... | 2026-10-19 |
| CVE-2026-107744 | medium | 6.5 | No | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to authorization bypass in all v... | 2026-10-19 |
| CVE-2026-104736 | critical | 9.8 | No | The LearnPress plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.4.10 via deserialization of un... | 2026-10-19 |
| CVE-2026-103899 | high | 7.2 | No | The EU VAT Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vat_number' parameter in all... | 2026-10-19 |
| CVE-2026-111602 | low | 3.7 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information... | 2026-10-19 |
| CVE-2026-111601 | medium | 6.1 | No | The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'token_id' parameter in a... | 2026-10-19 |
| CVE-2026-110653 | critical | 9.1 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass... | 2026-10-19 |
| CVE-2026-109208 | high | 7.2 | No | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-19 |
| CVE-2026-107763 | medium | 4.3 | No | The Fastcache by Host.it plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.5. This is due... | 2026-10-19 |
| CVE-2026-107762 | high | 7.5 | No | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in al... | 2026-10-19 |
| CVE-2026-104734 | high | 7.2 | No | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to PHP Object Injection in all versions u... | 2026-10-19 |
| CVE-2026-84012 | high | 8.1 | No | Double free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network. | 2026-10-19 |
| CVE-2026-84013 | high | 7.8 | No | Use after free in Windows Telephony Server allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-84014 | high | 7.0 | No | Heap-based buffer overflow in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-84015 | critical | 9.8 | No | Heap-based buffer overflow in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an unauthorized attacker to execute code over a net... | 2026-10-19 |
| CVE-2026-84016 | high | 7.8 | No | Out-of-bounds write in Windows EAPHost Service allows an authorized attacker to elevate privileges locally. | 2026-10-19 |
| CVE-2026-84017 | high | 7.5 | No | Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network. | 2026-10-19 |
| CVE-2026-111705 | medium | 4.3 | No | Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated members to read other memb... | 2026-10-19 |