Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111397 | medium | 5.3 | No | Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Retrieve Embedded Sens... | 2026-10-16 |
| CVE-2026-111396 | high | 7.1 | No | Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows Exploiting Incorrectly Conf... | 2026-10-16 |
| CVE-2026-110903 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Cale... | 2026-10-16 |
| CVE-2026-110901 | medium | 5.4 | No | Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting Incorrectly Configure... | 2026-10-16 |
| CVE-2026-110900 | medium | 5.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security... | 2026-10-16 |
| CVE-2026-110896 | medium | 5.3 | No | Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured Access Control Security... | 2026-10-16 |
| CVE-2026-110380 | medium | 5.3 | No | Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control... | 2026-10-16 |
| CVE-2026-111472 | not reported | — | No | An SQL injection vulnerability has been discovered in TSG Profleet. The vulnerability could allow an attacker to retrieve, create, update an... | 2026-10-16 |
| CVE-2026-101300 | not reported | — | No | Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of Wegow. According to the report, an authent... | 2026-10-16 |
| CVE-2026-97296 | high | 8.1 | No | Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects G... | 2026-10-16 |
| CVE-2026-96339 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflect... | 2026-10-16 |
| CVE-2026-94388 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-p... | 2026-10-16 |
| CVE-2026-94169 | critical | 10.0 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue a... | 2026-10-16 |
| CVE-2026-110366 | medium | 5.3 | No | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Securit... | 2026-10-16 |
| CVE-2026-111449 | medium | 5.9 | No | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrato... | 2026-10-16 |
| CVE-2026-111448 | low | 3.7 | No | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks... | 2026-10-16 |
| CVE-2026-111444 | critical | 9.8 | No | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application... | 2026-10-16 |
| CVE-2026-111443 | medium | 6.5 | No | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production... | 2026-10-16 |
| CVE-2026-110912 | not reported | — | No | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate t... | 2026-10-16 |
| CVE-2026-97470 | medium | 6.4 | No | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Co... | 2026-10-16 |