Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78471 | medium | 5.4 | No | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and includi... | 2026-10-03 |
| CVE-2026-75432 | medium | 5.1 | No | An issue in yaml-cpp 0.9.0 allows a remote attacker to obtain sensitive information via the src/scanner.cpp, Scanner::PopIndent(), and Scann... | 2026-10-03 |
| CVE-2026-32585 | medium | 6.5 | No | Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-03 |
| CVE-2026-66055 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift C++, Java, Go, netstd, Python and Delphi bindings. This... | 2026-10-03 |
| CVE-2026-66054 | not reported | — | No | Allocation of Resources Without Limits or Throttling, Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apac... | 2026-10-03 |
| CVE-2026-63772 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift go bindings. This issue affects Apache Thrift: before 0... | 2026-10-03 |
| CVE-2026-61374 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: before... | 2026-10-03 |
| CVE-2026-62073 | high | 7.5 | No | Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions. | 2026-10-03 |
| CVE-2026-19652 | critical | 9.8 | No | The Divi Membership plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 2.2.0. This is due to the `... | 2026-10-03 |
| CVE-2026-15897 | high | 8.8 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,... | 2026-10-03 |
| CVE-2026-19660 | critical | 9.8 | No | The Divi Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.0. The `process_pa... | 2026-10-03 |
| CVE-2026-14378 | critical | 9.8 | No | The DevKit Pro plugin for WordPress is vulnerable to Authentication Bypass Leading to Administrator Account Takeover in all versions up to,... | 2026-10-03 |
| CVE-2026-15983 | high | 8.1 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Arbitrary File/Directory Deletion in all versions up to, an... | 2026-10-03 |
| CVE-2026-19902 | medium | 6.1 | No | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in al... | 2026-10-03 |
| CVE-2026-19807 | high | 8.8 | No | The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includi... | 2026-10-03 |
| CVE-2026-104912 | not reported | — | No | MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that tri... | 2026-10-03 |
| CVE-2026-12951 | medium | 6.5 | No | The Dc Woocommerce Multi Vendor plugin for WordPress is vulnerable to SQL Injection via the 'order_by' parameter of the /multivendorx/v1/com... | 2026-10-03 |
| CVE-2026-10026 | high | 7.2 | No | The CTX Feed Pro plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 7.6.12. This is due to insuffici... | 2026-10-03 |
| CVE-2026-12241 | medium | 5.4 | No | The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data du... | 2026-10-03 |
| CVE-2026-104910 | not reported | — | No | MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a g... | 2026-10-03 |