Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97260 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in MaxGalleria <= 6.5.3 versions. | 2026-10-01 |
| CVE-2026-97251 | medium | 6.5 | No | Unauthenticated Insecure Direct Object References (IDOR) in Bus Ticket Booking with Seat Reservation <= 5.9.3 versions. | 2026-10-01 |
| CVE-2026-95588 | high | 8.6 | No | Unauthenticated Arbitrary File Deletion in AcyMailing SMTP Newsletter <= 11.0.5 versions. | 2026-10-01 |
| CVE-2026-94390 | high | 7.2 | No | Editor PHP Object Injection in Hide Shipping Method For WooCommerce <= 1.5.4 versions. | 2026-10-01 |
| CVE-2026-91817 | medium | 6.1 | No | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of wide strings in embedded PDF JavaScript. Insuf... | 2026-10-01 |
| CVE-2026-71542 | not reported | — | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior,... | 2026-10-01 |
| CVE-2026-71426 | not reported | — | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. In versions 3.3.22 and prior,... | 2026-10-01 |
| CVE-2026-56661 | high | 7.5 | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the upd... | 2026-10-01 |
| CVE-2026-56660 | critical | 9.1 | No | GetSimple CMS is a content management system (CMS), and GetSimple CMS CE is the community edition of that CMS. Prior to version 1.5, the upd... | 2026-10-01 |
| CVE-2026-7176 | not reported | — | No | CVE-2026-7176: the Help text and Title parameters in the endpoint /events/-/custom_form/edit during the process of creating or modifying for... | 2026-10-01 |
| CVE-2026-7175 | not reported | — | No | CVE-2026-7175: the Business Name parameter in the /promoters/edit endpoint of the My Profile section of a promoter’s profile, which allows t... | 2026-10-01 |
| CVE-2026-7174 | not reported | — | No | CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of t... | 2026-10-01 |
| CVE-2026-7173 | not reported | — | No | CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote at... | 2026-10-01 |
| CVE-2026-75786 | not reported | — | No | Unsanitized concatenation of the module parameter in the Grafana datasource endpoint allows authenticated blind SQL injection. Affects Pando... | 2026-10-01 |
| CVE-2026-64950 | not reported | — | No | Missing input validation and output encoding on the directory name parameter in File Manager's Create Directory allows stored XSS, executing... | 2026-10-01 |
| CVE-2026-64949 | not reported | — | No | Incomplete extension blacklist in the File Manager module allows authenticated upload and execution of arbitrary .phar files. Affects Pandor... | 2026-10-01 |
| CVE-2026-64948 | not reported | — | No | Missing authorization in module data retrieval allows unauthorized cross-group access to module history. Affects Pandora FMS from 777 onward... | 2026-10-01 |
| CVE-2026-64947 | not reported | — | No | A chained CSRF bypass and unrestricted file upload vulnerability in the Plugin File Manager allows an attacker to upload and execute arbitra... | 2026-10-01 |
| CVE-2026-55231 | high | 7.2 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, a flawed c... | 2026-10-01 |
| CVE-2026-55230 | high | 8.7 | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.6, Vvveb's HT... | 2026-10-01 |