Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102427 | critical | 10.0 | No | Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached throu... | 2026-10-01 |
| CVE-2026-81158 | medium | 5.3 | No | Incorrect Authorization vulnerability in Drupal Entity API allows Forceful Browsing. This issue affects Entity API versions: from 0.0.0 to 1... | 2026-10-01 |
| CVE-2026-81160 | medium | 6.1 | No | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XS... | 2026-10-01 |
| CVE-2026-82300 | medium | 6.5 | No | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). | 2026-10-01 |
| CVE-2026-103656 | not reported | — | No | Rejected reason: this is rejected | 2026-10-01 |
| CVE-2026-16272 | critical | 9.1 | No | Use of less trusted source vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module al... | 2026-10-01 |
| CVE-2026-16037 | high | 7.5 | No | Observable timing discrepancy vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iFrame API WHMCS Module... | 2026-10-01 |
| CVE-2026-16025 | high | 7.5 | No | Improper validation of specified quantity in input vulnerability in PayTR Payment and Electronic Money Institution Inc. PayTR Virtual Pos iF... | 2026-10-01 |
| CVE-2026-96255 | high | 7.5 | No | The Payments for Hubtel WordPress plugin before 1.0.2 does not prevent public access to a debug log in which it records payment requests, in... | 2026-10-01 |
| CVE-2026-96200 | medium | 5.3 | No | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from... | 2026-10-01 |
| CVE-2026-96173 | medium | 5.3 | No | The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that the requester is authorized to view an order before redirecting a... | 2026-10-01 |
| CVE-2026-92412 | high | 7.1 | No | The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an... | 2026-10-01 |
| CVE-2026-90974 | medium | 6.5 | No | The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initializatio... | 2026-10-01 |
| CVE-2026-90972 | medium | 5.4 | No | The WP Fusion Lite WordPress plugin before 3.48.0 does not perform a capability check on two of its admin AJAX handlers, allowing any authen... | 2026-10-01 |
| CVE-2026-89296 | high | 8.6 | No | The Pro Like Button WordPress plugin before 2.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing u... | 2026-10-01 |
| CVE-2026-87973 | low | 3.1 | No | The If-So Dynamic Content WordPress plugin before 1.10.2 does not sanitize a conversion name before storing it, nor escape it when rendering... | 2026-10-01 |
| CVE-2026-87970 | medium | 4.7 | No | The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated... | 2026-10-01 |
| CVE-2026-86610 | medium | 6.4 | No | The Download Manager WordPress plugin before 3.3.71 does not sufficiently sanitise and escape a package setting before outputting it back in... | 2026-10-01 |
| CVE-2026-81809 | high | 7.5 | No | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not properly escape data taken from payment callbacks before using it in a SQL... | 2026-10-01 |
| CVE-2026-81739 | high | 7.5 | No | The Paytm Payment Gateway WordPress plugin before 2.8.9 does not sanitize and escape data it stores from payment callbacks before outputting... | 2026-10-01 |