Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-88920 | critical | 9.8 | No | An authentication bypass in the DOM security processor in Apache WSS4J allows unauthenticated remote attackers to forge authenticated SOAP m... | 2026-10-02 |
| CVE-2026-92820 | high | 8.1 | No | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to arbitrary file operations in all versions up to, and including, 3.3.34... | 2026-10-02 |
| CVE-2026-84925 | medium | 6.1 | No | The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'lang' p... | 2026-10-02 |
| CVE-2026-93367 | high | 7.2 | No | The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versi... | 2026-10-02 |
| CVE-2026-71454 | not reported | — | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in CWE-79 - Cross-site Scripting CAPEC-63... | 2026-10-02 |
| CVE-2026-71453 | not reported | — | No | - External Control of File Name or Path vulnerability in Johnson Controls EasyIO FS32 allows - traversal attack. This issue affects EasyIO... | 2026-10-02 |
| CVE-2026-71448 | not reported | — | No | : Insecure Default Initialization of Resource vulnerability in Johnson Controls EasyIO FS32 allows : Authentication Abuse. This issue affec... | 2026-10-02 |
| CVE-2026-67989 | high | 7.5 | No | crmne/ruby_llm at commit fa6f279847d6d7027814539d9c0dfc3bbdfd2a83 contains a polynomial-time regular expression denial-of-service condition... | 2026-10-02 |
| CVE-2026-64893 | not reported | — | No | - Cleartext Transmission of Sensitive Information vulnerability in Johnson Controls EasyIO NEO allows - Man In the Middle Attack. This issu... | 2026-10-02 |
| CVE-2026-64892 | not reported | — | No | - Exposure of Sensitive Information vulnerability in Johnson Controls Easy IO Neo allows Collect Data from Common Resource Locations. This... | 2026-10-02 |
| CVE-2026-51907 | high | 8.1 | No | In TaskingAI v0.3.0 in the QR Code Generator plugin save_base64_image function, a path traversal vulnerability allows attackers to write ima... | 2026-10-02 |
| CVE-2026-34494 | not reported | — | No | - On-Chip Debug Interface vulnerability in Johnson Controls Neo Series MVP2 allows Collect Data from Common Resource Locations. This issue... | 2026-10-02 |
| CVE-2026-34493 | not reported | — | No | - On-Chip Debug Interface vulnerability in Johnson Controls EasyIO FS32 allows Collect Data from Common Resource Locations. This issue affe... | 2026-10-02 |
| CVE-2026-18397 | not reported | — | No | This vulnerability enables unauthenticated remote code execution (RCE) on a victim's machine by exploiting a combination of cryptographic we... | 2026-10-02 |
| CVE-2026-51858 | critical | 9.8 | No | In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, TerminalToolkit.shell_exec allows prompt-driven shell command execution without an appr... | 2026-10-02 |
| CVE-2026-15896 | critical | 9.1 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6... | 2026-10-02 |
| CVE-2026-104054 | medium | 6.3 | No | A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file Booki... | 2026-10-02 |
| CVE-2026-103097 | high | 7.5 | No | An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensit... | 2026-10-02 |
| CVE-2026-103096 | high | 7.5 | No | API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive... | 2026-10-02 |
| CVE-2026-103765 | critical | 9.4 | No | Mooncake through 0.3.13.post1 contains a missing authentication vulnerability in the HTTP metadata server /metadata handler that allows unau... | 2026-10-02 |