Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103277 | high | 8.1 | No | Ghost versions from 2.5.0 before 6.34.0 contain an untrusted script execution vulnerability in the oEmbed preview feature that fails to sand... | 2026-10-01 |
| CVE-2026-103276 | medium | 5.3 | No | Ghost versions before 6.20.0 contain a file extension filtering bypass vulnerability that allows unauthenticated attackers to read theme tem... | 2026-10-01 |
| CVE-2026-103273 | medium | 4.3 | No | Ghost versions 4.3.0 before 6.58.0 contain an authentication bypass vulnerability where lower-privilege staff users can use staff tokens to... | 2026-10-01 |
| CVE-2026-103268 | high | 8.8 | No | Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts t... | 2026-10-01 |
| CVE-2026-95340 | medium | 4.3 | No | Incorrect authorization in PictureInPicture in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering... | 2026-10-01 |
| CVE-2026-95342 | medium | 4.3 | No | Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML... | 2026-10-01 |
| CVE-2026-95344 | high | 8.0 | No | Race condition in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass site is... | 2026-10-01 |
| CVE-2026-102584 | medium | 4.3 | No | A flaw was found in Moodle. Due to a missing capability check, a low-privileged authenticated user can trigger the recalculation of grade pe... | 2026-10-01 |
| CVE-2026-102585 | medium | 4.3 | No | A flaw was found in Moodle. When enrolling a user into a course while assigning them to a group, the application does not verify whether the... | 2026-10-01 |
| CVE-2026-102578 | high | 8.8 | No | A flaw was found in Moodle. An authenticated attacker with access to the question bank web service can submit unsanitized input directly int... | 2026-10-01 |
| CVE-2026-102580 | medium | 4.3 | No | A flaw was found in Moodle. An authenticated attacker can supply an improperly validated audience class name to the Report Builder component... | 2026-10-01 |
| CVE-2026-62063 | medium | 5.4 | No | Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Contr... | 2026-10-01 |
| CVE-2026-62061 | medium | 5.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in Metagauss ProfileGrid profilegrid-user-profiles-groups-and-communities all... | 2026-10-01 |
| CVE-2026-62060 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in captivateaudio Captivate Sync captivat... | 2026-10-01 |
| CVE-2026-62059 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ultimate Member Ultimate Member ultima... | 2026-10-01 |
| CVE-2026-62058 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in WPExperts CF7 Apps contact-form-7-honeypot allows Retrieve Embedded Sensi... | 2026-10-01 |
| CVE-2026-103345 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitiv... | 2026-10-01 |
| CVE-2026-103343 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP ManageNinja LLC FluentForm fluentfo... | 2026-10-01 |
| CVE-2026-103341 | medium | 5.3 | No | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-eleme... | 2026-10-01 |
| CVE-2026-103339 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet Metform metform allows Stored XS... | 2026-10-01 |