Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-9187 | critical | 9.8 | No | Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that w... | 2026-09-30 |
| CVE-2026-70658 | high | 7.4 | No | Pay is a payments engine for Ruby on Rails 6.0 and higher. Prior to 11.6.2, Pay::Webhooks::PaddleBillingController#valid_signature? in app/c... | 2026-09-30 |
| CVE-2026-103474 | high | 8.8 | No | yii2-starter-kit through 4.2.0 fails to validate file types in the backend storage upload actions, allowing authenticated managers to upload... | 2026-09-30 |
| CVE-2026-47253 | high | 7.3 | No | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, the clear_plugin_cache(plugin) SQL scalar function in namespace/othe... | 2026-09-30 |
| CVE-2026-61701 | high | 8.8 | No | Laravel MagicLink creates links for authentication without a password or for accessing private content. From 2.0.0 until 2.25.1, MagicLink s... | 2026-09-30 |
| CVE-2026-59178 | critical | 9.8 | No | ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software. Prior to version 1.0.12, the dashboard reads its a... | 2026-09-30 |
| CVE-2026-97291 | high | 8.8 | No | Contributor PHP Object Injection in Schema & Structured Data for WP & AMP <= 1.66 versions. | 2026-09-30 |
| CVE-2026-97290 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions. | 2026-09-30 |
| CVE-2026-97265 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine al... | 2026-09-30 |
| CVE-2026-97256 | high | 7.2 | No | Editor PHP Object Injection in Page Builder by SiteOrigin <= 2.36.0 versions. | 2026-09-30 |
| CVE-2026-102397 | medium | 6.5 | No | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions. | 2026-09-30 |
| CVE-2026-102392 | high | 7.2 | No | Shop manager PHP Object Injection in Extra Product Options For WooCommerce | Custom Product Addons and Fields <= 3.3.8 versions. | 2026-09-30 |
| CVE-2026-102391 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions. | 2026-09-30 |
| CVE-2026-102377 | high | 8.8 | No | Contributor PHP Object Injection in Photo Gallery by 10Web <= 1.8.46 versions. | 2026-09-30 |
| CVE-2026-102376 | high | 7.1 | No | Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions. | 2026-09-30 |
| CVE-2026-100512 | critical | 9.8 | No | Contributor PHP Object Injection in Nested Pages <= 3.3.2 versions. | 2026-09-30 |
| CVE-2026-100510 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions. | 2026-09-30 |
| CVE-2026-97064 | critical | 9.1 | No | X-SpringBoot through 6.0 ships with a hardcoded static master login verification code 172839 enabled by default in the database seed. Unauth... | 2026-09-30 |
| CVE-2026-69272 | high | 7.1 | No | Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attacker to elevate privileges over a network. | 2026-09-30 |
| CVE-2026-93366 | medium | 5.4 | No | Bludit CMS through 3.22.0 contains an authorization bypass vulnerability that allows authenticated users with the Author role to enumerate a... | 2026-09-30 |