Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103263 | medium | 5.9 | No | Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without... | 2026-10-01 |
| CVE-2026-103543 | medium | 6.3 | No | A vulnerability has been found in itsourcecode Leave Management System 1.0. The affected element is an unknown function of the file /module/... | 2026-10-01 |
| CVE-2026-103540 | medium | 6.3 | No | A security vulnerability has been detected in formtools.org Form Tools up to 3.1.1. This vulnerability affects the function Clients::updateC... | 2026-10-01 |
| CVE-2026-103536 | high | 7.3 | No | A vulnerability was identified in ZongXR Supermarket 1.0.0.0. Affected by this vulnerability is the function OrderController.addOrder of the... | 2026-10-01 |
| CVE-2026-103259 | high | 7.6 | No | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a session token leakage vulnerability in the Dynamic Credentials authorize and r... | 2026-10-01 |
| CVE-2026-103255 | critical | 9.0 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase... | 2026-10-01 |
| CVE-2026-103251 | high | 7.1 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the commu... | 2026-10-01 |
| CVE-2026-103247 | high | 8.5 | No | n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua... | 2026-10-01 |
| CVE-2026-103082 | high | 7.2 | No | Server-Side Request Forgery (SSRF) vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Server Side Re... | 2026-10-01 |
| CVE-2026-101887 | low | 3.5 | No | BlueALSA (bluez-alsa/bluealsad) contains a division-by-zero vulnerability in the LC3plus sink decoder (a2dp-lc3plus.c, a2dp_lc3plus_dec_thre... | 2026-10-01 |
| CVE-2020-0796 | critical | 10.0 | Listed | A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque... | 2026-10-01 |
| CVE-2018-6882 | medium | 6.1 | Listed | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7... | 2026-10-01 |
| CVE-2018-19953 | medium | 6.1 | Listed | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issu... | 2026-10-01 |
| CVE-2018-15982 | high | 7.8 | Listed | Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could... | 2026-10-01 |
| CVE-2016-1019 | critical | 9.8 | Listed | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbit... | 2026-10-01 |
| CVE-2012-1710 | critical | 9.8 | Listed | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers t... | 2026-10-01 |
| CVE-2026-97661 | high | 7.2 | No | The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'gateway' Form Field in all... | 2026-10-01 |
| CVE-2026-96268 | medium | 6.4 | No | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-da... | 2026-10-01 |
| CVE-2026-90992 | medium | 6.4 | No | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in... | 2026-10-01 |
| CVE-2026-85235 | high | 7.2 | No | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-10-01 |