Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79896 | high | 7.5 | No | Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthe... | 2026-10-01 |
| CVE-2026-12627 | critical | 9.8 | No | Fortra's Core Privileged Access Manager (BoKS) contains a stack-based buffer overflow vulnerability in boks_autoregisterd. A remote attacker... | 2026-10-01 |
| CVE-2026-79900 | medium | 6.5 | No | boks_ksllogsd accepts a checksum algorithm name in the MD field of an authenticated KSL start message. Affected releases verify that OpenSSL... | 2026-10-01 |
| CVE-2026-79899 | high | 7.9 | No | Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files wit... | 2026-10-01 |
| CVE-2026-79898 | critical | 9.1 | No | Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, t... | 2026-10-01 |
| CVE-2026-103690 | medium | 6.3 | No | A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/control... | 2026-10-01 |
| CVE-2026-62071 | critical | 9.3 | No | Unauthenticated SQL Injection in WordPress File Upload <= 5.1.10 versions. | 2026-10-01 |
| CVE-2026-103752 | critical | 9.8 | No | Unauthenticated Privilege Escalation in Authorizer <= 3.15.3 versions. | 2026-10-01 |
| CVE-2026-103687 | high | 7.3 | No | A vulnerability has been found in rhukster dom-sanitizer up to 1.0.15. The affected element is the function url of the file src/DOMSanitizer... | 2026-10-01 |
| CVE-2026-103347 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in hCaptcha for WP <= 5.3.0 versions. | 2026-10-01 |
| CVE-2026-103068 | high | 8.8 | No | Subscriber Privilege Escalation in ByteCoreStack – MCP Connector for AI Tools <= 1.2.2 versions. | 2026-10-01 |
| CVE-2026-102378 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Parallax Section block <= 2.0.4 versions. | 2026-10-01 |
| CVE-2026-100514 | high | 7.5 | No | Unauthenticated Insecure Direct Object References (IDOR) in REST API Log <= 1.7.2 versions. | 2026-10-01 |
| CVE-2026-97297 | high | 7.6 | No | Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions. | 2026-10-01 |
| CVE-2026-97284 | high | 8.8 | No | Contributor PHP Object Injection in Icegram <= 3.1.31 versions. | 2026-10-01 |
| CVE-2026-97281 | medium | 6.3 | No | Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions. | 2026-10-01 |
| CVE-2026-97280 | medium | 6.5 | No | Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-01 |
| CVE-2026-97277 | high | 7.6 | No | Subscriber Broken Access Control in Social Boost <= 3.6.2 versions. | 2026-10-01 |
| CVE-2026-97269 | medium | 6.5 | No | Unauthenticated Insecure Direct Object References (IDOR) in WPFunnels <= 3.13.1 versions. | 2026-10-01 |
| CVE-2026-97268 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Premmerce Wishlist for WooCommerce <= 1.1.13 versions. | 2026-10-01 |