Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15989 | critical | 9.8 | No | The Super Forms – Drag & Drop Form Builder plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including,... | 2026-10-01 |
| CVE-2026-103336 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows... | 2026-10-01 |
| CVE-2026-103260 | medium | 4.0 | No | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat... | 2026-10-01 |
| CVE-2026-103256 | high | 7.1 | No | n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password... | 2026-10-01 |
| CVE-2026-103252 | high | 7.7 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the c... | 2026-10-01 |
| CVE-2026-103248 | critical | 9.0 | No | n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba... | 2026-10-01 |
| CVE-2026-101012 | high | 7.3 | No | A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an un... | 2026-10-01 |
| CVE-2026-100897 | medium | 5.5 | No | A security vulnerability has been detected in fuzui StudentInfo up to fcc42a639ec7cef620651bfd0f07ebb660529e3f. The impacted element is an u... | 2026-10-01 |
| CVE-2026-100894 | medium | 6.3 | No | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This issue affects... | 2026-10-01 |
| CVE-2026-100891 | high | 7.3 | No | A vulnerability has been found in Trusted Domain Project OpenDMARC up to 1.4.2. Affected by this issue is the function opendmarc_policy_quer... | 2026-10-01 |
| CVE-2026-102577 | medium | 4.3 | No | A flaw was found in Moodle. Incorrect handling of IPv4-mapped IPv6 addresses within the URL downloader's host-blocking logic allows an authe... | 2026-10-01 |
| CVE-2026-95370 | medium | 5.4 | No | Inappropriate implementation in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass system access restrictions v... | 2026-10-01 |
| CVE-2026-95375 | medium | 6.3 | No | Incorrect authorization in BrowserTag in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer pro... | 2026-10-01 |
| CVE-2026-95376 | high | 8.0 | No | Externally controlled reference in DevTools in Google Chrome prior to 154.0.8037.57 allowed an adjacent attacker leveraging social engineeri... | 2026-10-01 |
| CVE-2026-95362 | high | 8.8 | No | Cross-site request forgery in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to by... | 2026-10-01 |
| CVE-2026-95364 | medium | 5.4 | No | Improper input validation in Passwords in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to spoof UI elements via a crafted... | 2026-10-01 |
| CVE-2026-95365 | high | 8.8 | No | Type confusion in IndexedDB in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code inside t... | 2026-10-01 |
| CVE-2026-95367 | medium | 5.3 | No | Information leak in DataTransfer in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process... | 2026-10-01 |
| CVE-2026-95368 | medium | 4.3 | No | Incorrect authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to poten... | 2026-10-01 |
| CVE-2026-95369 | high | 8.8 | No | Inappropriate implementation in XML in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to potentially execute arbitrary code... | 2026-10-01 |