Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-85004 | medium | 4.3 | No | The Popup Maker WordPress plugin through 1.4.5 does not perform a capability check on one of its account-connection actions, only verifying... | 2026-10-02 |
| CVE-2026-81740 | medium | 5.3 | No | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not verify that payment callbacks genuinely originate from the payment provider... | 2026-10-02 |
| CVE-2026-13718 | medium | 6.8 | No | The Tabs Responsive WordPress plugin through 2.5 does not sanitize the content of WooCommerce product tabs before storing and rendering it,... | 2026-10-02 |
| CVE-2026-103760 | medium | 5.9 | No | Mooncake transfer engine through 0.3.13.post1 contains a denial of service vulnerability that allows unauthenticated remote attackers to blo... | 2026-10-02 |
| CVE-2026-101890 | medium | 5.4 | No | The Prime Mover plugin for WordPress before 2.2.1 contains a stored cross-site scripting vulnerability that allows attackers to execute arbi... | 2026-10-02 |
| CVE-2026-101889 | medium | 6.5 | No | The Prime Mover plugin for WordPress before 2.2.1 contains a path traversal vulnerability that allows authenticated administrators to delete... | 2026-10-02 |
| CVE-2026-101888 | high | 7.2 | No | The Prime Mover plugin for WordPress before 2.2.1 contains a Zip Slip path traversal vulnerability that allows authenticated administrators... | 2026-10-02 |
| CVE-2026-67624 | medium | 6.5 | No | Out-of-bounds read in SQL Server allows an authorized attacker to disclose information over a network. | 2026-10-02 |
| CVE-2026-47297 | high | 8.1 | No | Deserialization of untrusted data in SQL Server allows an unauthorized attacker to execute code over a network. | 2026-10-02 |
| CVE-2026-104721 | not reported | — | No | Path-traversal vulnerability in QOS.CH Sarl Logback-classic on Java (logback-classic module) allows path-traversal vulnerability. More speci... | 2026-10-02 |
| CVE-2026-104733 | not reported | — | No | User Impersonation in ProcessOnes XMMP Server ejabberd <= 26.04 allows an attacker to impersonate arbitrary users via unvalidated authzid pa... | 2026-10-02 |
| CVE-2026-104435 | high | 7.4 | No | Zebra zebrad 4.4.0 and zebra-script 6.0.0 fail to enforce a ZIP-244 consensus rule, accepting V5 transparent inputs signed with SIGHASH_SING... | 2026-10-02 |
| CVE-2026-104434 | medium | 6.5 | No | ZcashFoundation Zebra zebra-rpc before 8.0.0 and zebrad before 4.5.0 contain a reachable assertion in the z_listunifiedreceivers RPC handler... | 2026-10-02 |
| CVE-2026-104431 | high | 7.5 | No | Zebra before 6.0.0 contains a denial of service vulnerability that allows unauthenticated peers to stall Tokio workers by submitting mempool... | 2026-10-02 |
| CVE-2026-104430 | high | 7.5 | No | Zebra zebrad 4.5.0 and zebra-script 7.0.0 count P2SH redeem script signature operations in legacy mode rather than zcashd's accurate P2SH mo... | 2026-10-02 |
| CVE-2026-104429 | medium | 5.3 | No | Zebra (zebrad) 5.0.0 before 6.0.0-rc.0 does not apply its per-peer mempool admission cap to transactions received as direct P2P tx messages,... | 2026-10-02 |
| CVE-2026-104426 | medium | 5.9 | No | Zebra before 6.1.0 contains an inefficient algorithmic complexity vulnerability in remaining_transaction_value that clones the entire block-... | 2026-10-02 |
| CVE-2026-104425 | medium | 5.3 | No | ZcashFoundation Zebra before 6.1.0 contains a resource exhaustion vulnerability that allows unauthenticated peers to degrade block processin... | 2026-10-02 |
| CVE-2026-104423 | high | 7.5 | No | Zebra (zebrad) before 6.2.1 contains an asymmetric resource consumption vulnerability that allows unauthenticated peers to stall block verif... | 2026-10-02 |
| CVE-2026-104421 | medium | 5.3 | No | Zebra before 6.2.1 contains an incomplete cleanup vulnerability that allows unauthenticated peers to block downloading of valid blocks by le... | 2026-10-02 |