Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104479 | medium | 5.4 | No | Shopclass before 6.2.0 contains a stored cross-site scripting vulnerability that allows self-registered non-admin users to inject scripts in... | 2026-10-06 |
| CVE-2026-104476 | medium | 5.9 | No | Backdrop CMS before 1.35.1 contains an information disclosure vulnerability that allows unauthenticated attackers to retrieve configuration... | 2026-10-06 |
| CVE-2026-104433 | high | 7.5 | No | Mooncake transfer engine before 0.3.12 contains an out-of-bounds read vulnerability in the readString function of include/common.h that allo... | 2026-10-06 |
| CVE-2026-82045 | medium | 6.5 | No | UTMStack before 11.2.16 contains a JPQL injection vulnerability that allows authenticated attackers to read arbitrary entity data by exploit... | 2026-10-06 |
| CVE-2026-82044 | high | 7.7 | No | UTMStack before 11.2.16 contains a server-side request forgery vulnerability that allows authenticated attackers to make the server request... | 2026-10-06 |
| CVE-2026-82042 | critical | 9.8 | No | UTMStack before 11.2.16 contains an authentication bypass vulnerability that allows remote attackers to gain full administrative API access... | 2026-10-06 |
| CVE-2026-82040 | medium | 5.0 | No | UTMStack before 11.2.16 contains a server-side request forgery vulnerability in IdentityProviderService.validateMetadataUrl() that allows au... | 2026-10-06 |
| CVE-2026-82039 | high | 8.8 | No | UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder() that allows authenticated attack... | 2026-10-06 |
| CVE-2026-81477 | high | 7.2 | No | Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Heap-based Buffer Overflow vulnerability. A high privileged att... | 2026-10-06 |
| CVE-2026-105789 | medium | 5.4 | No | Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute_command tool... | 2026-10-06 |
| CVE-2026-103831 | not reported | — | No | CVE-2026-103831: Insecure deserialization vulnerability in the Psr16CacheAdapter component of the TrueLayer Magento 2 Plugin, due to the use... | 2026-10-06 |
| CVE-2026-4889 | not reported | — | No | SQL injection (SQLi) vulnerability in the eLoanApp application, specifically in the POST parameter 'logina' of the user process endpoint '/a... | 2026-10-06 |
| CVE-2026-94299 | medium | 6.5 | No | The elegro Crypto Payment WordPress plugin through 1.0.1 does not require a shared secret to be configured before trusting incoming payment... | 2026-10-06 |
| CVE-2026-94278 | medium | 5.5 | No | The File Media Renamer WordPress plugin through 1.3 does not verify that the requesting user is authorised to modify a given media attachmen... | 2026-10-06 |
| CVE-2026-94271 | medium | 5.3 | No | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the payment with the payment provider when handling the return from... | 2026-10-06 |
| CVE-2026-94270 | medium | 5.3 | No | The Deema Payment Gateway WordPress plugin through 1.1.2 does not verify the authenticity of incoming payment provider notifications, and sh... | 2026-10-06 |
| CVE-2026-89289 | medium | 5.3 | No | The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing... | 2026-10-06 |
| CVE-2026-86786 | medium | 5.3 | No | The Slider Pro WordPress plugin through 1.0.0 does not perform any capability or authorisation check on one of its AJAX actions, allowing un... | 2026-10-06 |
| CVE-2026-104811 | not reported | — | No | DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the prod... | 2026-10-06 |
| CVE-2026-104810 | not reported | — | No | This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication... | 2026-10-06 |