Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103490 | high | 7.2 | No | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | 2026-10-05 |
| CVE-2026-80276 | high | 7.5 | No | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 expose a network-accessible management interface... | 2026-10-05 |
| CVE-2026-80275 | high | 8.8 | No | Comelit Multi-User Gateway for VIP System (model 1456B) firmware versions 2.9.1 and 2.10.0 fail to enforce server-side authorization on an a... | 2026-10-05 |
| CVE-2026-81793 | medium | 6.5 | No | Missing Authorization vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Exploiting Incorrectly Configured Acc... | 2026-10-05 |
| CVE-2026-39601 | low | 3.7 | No | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in WPdevelop Booking Calendar book... | 2026-10-05 |
| CVE-2026-93495 | not reported | — | No | Improper initialization in an ASUS certain motherboard allows an physically proximate user to read or write arbitrary memory by inserting a... | 2026-10-05 |
| CVE-2026-104470 | medium | 5.0 | No | YesWiki before 4.6.7 contains a server-side request forgery vulnerability that allows page editors to make the server fetch arbitrary URLs v... | 2026-10-04 |
| CVE-2026-103111 | high | 7.6 | No | PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with ar... | 2026-10-04 |
| CVE-2026-100630 | medium | 5.4 | No | AVideo before 29.1.0 contains a stored cross-site scripting vulnerability in the video trailer1 field rendered unsanitized within an inline... | 2026-10-04 |
| CVE-2026-97652 | medium | 6.1 | No | The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Reflected Cross-Site Scripti... | 2026-10-03 |
| CVE-2026-97641 | high | 7.2 | No | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to... | 2026-10-03 |
| CVE-2026-97637 | critical | 9.8 | No | The JSON API Auth plugin for WordPress is vulnerable to Authentication Bypass via Cached Session Cookie Disclosure in all versions up to, an... | 2026-10-03 |
| CVE-2026-97342 | high | 7.2 | No | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'choice' Post Meta vi... | 2026-10-03 |
| CVE-2026-97338 | medium | 6.4 | No | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Display Name in all versions up to, and including... | 2026-10-03 |
| CVE-2026-96871 | high | 7.2 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and in... | 2026-10-03 |
| CVE-2026-97273 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | 2026-10-03 |
| CVE-2026-97258 | medium | 6.5 | No | Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions. | 2026-10-03 |
| CVE-2026-96613 | medium | 6.5 | No | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete d... | 2026-10-03 |
| CVE-2026-96647 | medium | 6.4 | No | The Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting v... | 2026-10-03 |
| CVE-2026-96567 | high | 7.2 | No | The MW WP Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_id' parameter in all versions up to, and incl... | 2026-10-03 |