Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104018 | high | 8.8 | No | An improper privilege management vulnerability (CWE-269) exists in the command shell of Wind River VxWorks 7 when configured to enforce per-... | 2026-10-02 |
| CVE-2026-103922 | critical | 9.3 | No | Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and i... | 2026-10-02 |
| CVE-2026-93304 | low | 3.7 | No | A (D)TLS 1.2 client can accept a ChangeCipherSpec message before it has sent its ClientKeyExchange. No master secret has been derived at tha... | 2026-10-02 |
| CVE-2026-77912 | medium | 5.4 | No | A stored cross-site scripting (XSS) vulnerability was identified in GitHub Enterprise Server that allowed an authenticated attacker to injec... | 2026-10-02 |
| CVE-2026-77987 | critical | 9.8 | No | A server-side request forgery (SSRF) vulnerability was identified in the notebook viewer of GitHub Enterprise Server. The notebook viewer va... | 2026-10-02 |
| CVE-2026-104848 | not reported | — | No | Tinypool is a minimal Node.js worker thread pool implementation. Prior to 2.1.1, Tinypool constructs ThreadPool.options from a normal option... | 2026-10-02 |
| CVE-2026-73976 | not reported | — | No | djehuty is a research data repository system developed by 4TU.ResearchData. Prior to version 26.3.2, An unauthenticated attacker can inject... | 2026-10-02 |
| CVE-2026-97663 | high | 7.2 | No | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versio... | 2026-10-02 |
| CVE-2026-97634 | medium | 6.5 | No | The Event Tickets and Registration plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions u... | 2026-10-02 |
| CVE-2026-96292 | not reported | — | No | Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affec... | 2026-10-02 |
| CVE-2026-97336 | high | 7.2 | No | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'file_list' Field Type in all versions up to, and including,... | 2026-10-02 |
| CVE-2026-96578 | high | 7.2 | No | The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in a... | 2026-10-02 |
| CVE-2026-97286 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-te... | 2026-10-02 |
| CVE-2026-96287 | not reported | — | No | Inefficient Algorithmic Complexity vulnerability in Apache Thrift Perl bindings. This issue affects Apache Thrift: before 0.25.0. Users ar... | 2026-10-02 |
| CVE-2026-94658 | not reported | — | No | Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are... | 2026-10-02 |
| CVE-2026-94657 | not reported | — | No | Allocation of resources without limits or throttling vulnerability in Apache Thrift JavaME bindings. This issue affects Apache Thrift: befo... | 2026-10-02 |
| CVE-2026-94656 | not reported | — | No | Allocation of resources without limits or throttling vulnerability in Apache Thrift ruby bindings. This issue affects Apache Thrift: before... | 2026-10-02 |
| CVE-2026-94655 | not reported | — | No | Allocation of resources without limits or throttling, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This... | 2026-10-02 |
| CVE-2026-94654 | not reported | — | No | Loop with unreachable exit condition ('infinite loop') vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: be... | 2026-10-02 |
| CVE-2026-95662 | not reported | — | No | Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to tric... | 2026-10-02 |