Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19253 | high | 8.7 | No | The Cache Enabler WordPress plugin before 1.8.17 does not validate a URL before using it to build a filesystem path in its cache purge routi... | 2026-10-01 |
| CVE-2026-101148 | critical | 10.0 | No | The BackupSheep WordPress Backup Plugin WordPress plugin through 1.8 does not properly validate its integration key, treating an unset or bl... | 2026-10-01 |
| CVE-2026-101147 | high | 8.8 | No | The Featured Image from URL (FIFU) WordPress plugin before 6.0.8, Featured Image from URL (FIFU) Premium WordPress plugin before 8.2.8 do no... | 2026-10-01 |
| CVE-2026-69594 | high | 7.8 | No | Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally... | 2026-10-01 |
| CVE-2026-69549 | high | 7.0 | No | Out-of-bounds read in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 2026-10-01 |
| CVE-2026-69546 | high | 8.1 | No | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 2026-10-01 |
| CVE-2026-69541 | high | 7.8 | No | Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally. | 2026-10-01 |
| CVE-2026-103548 | not reported | — | No | Improperly stored passwords in the config file in Itron MV-90 xi 3.0 allows attackers to decode the passwords and password histories to gain... | 2026-10-01 |
| CVE-2026-69524 | high | 8.1 | No | Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network. | 2026-10-01 |
| CVE-2025-6558 | high | 8.8 | Listed | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentiall... | 2026-10-01 |
| CVE-2026-94684 | not reported | — | No | Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. False positive detection. | 2026-10-01 |
| CVE-2026-93464 | medium | 5.4 | No | A stored cross-site scripting vulnerability via custom content descriptions exists in baserCMS. If this vulnerability is exploited, an arbit... | 2026-10-01 |
| CVE-2026-93462 | medium | 5.3 | No | A missing authentication for critical function vulnerability exists in baserCMS. If this vulnerability is exploited, a remote attacker may o... | 2026-10-01 |
| CVE-2026-93460 | medium | 5.4 | No | A stored cross-site scripting vulnerability via appended strings in email form fields exists in baserCMS. If this vulnerability is exploited... | 2026-10-01 |
| CVE-2026-84063 | medium | 6.5 | No | BurgerEditor 3.2.0 through 3.4.0 contains an issue with unrestricted upload of file with dangerous type. If this vulnerability is exploited,... | 2026-10-01 |
| CVE-2026-84062 | medium | 4.3 | No | BurgerEditor 3.0.0 through 3.4.0 contains an issue with authorization bypass through user-controlled key. If this vulnerability is exploited... | 2026-10-01 |
| CVE-2026-95327 | medium | 6.5 | No | Information leak in Networking in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to leak sensitive information via a crafted... | 2026-10-01 |
| CVE-2026-89032 | high | 7.7 | No | BerriAI LiteLLM before 1.101.0-rc.1 contains a tenant isolation bypass vulnerability in the semantic cache layer that allows authenticated u... | 2026-10-01 |
| CVE-2026-81433 | not reported | — | No | A stack-based buffer overflow vulnerability in WatchGuard Fireware OS's DHCP fingerprinting daemon (fingerd) allows an unauthenticated attac... | 2026-10-01 |
| CVE-2026-76732 | medium | 6.4 | No | A local privilege-escalation vulnerability has been discovered in the affected daemon of HPE Networking Instant ON. Successful exploitation... | 2026-10-01 |