Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89294 | high | 7.5 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27... | 2026-09-30 |
| CVE-2026-86450 | high | 7.5 | No | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal a... | 2026-09-30 |
| CVE-2026-86158 | high | 7.7 | No | Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticate... | 2026-09-30 |
| CVE-2026-86157 | medium | 5.6 | No | Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker... | 2026-09-30 |
| CVE-2026-75098 | high | 7.5 | No | The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg'... | 2026-09-30 |
| CVE-2026-18783 | high | 8.8 | No | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication B... | 2026-09-30 |
| CVE-2026-18782 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Syste... | 2026-09-30 |
| CVE-2026-82307 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG... | 2026-09-30 |
| CVE-2026-86778 | medium | 5.3 | No | Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account... | 2026-09-30 |
| CVE-2026-6806 | high | 7.5 | No | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_l... | 2026-09-30 |
| CVE-2026-6173 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's... | 2026-09-30 |
| CVE-2026-6172 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_im... | 2026-09-30 |
| CVE-2026-6171 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_ico... | 2026-09-30 |
| CVE-2026-6170 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css... | 2026-09-30 |
| CVE-2026-65102 | high | 7.8 | No | NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAM... | 2026-09-30 |
| CVE-2026-62097 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-di... | 2026-09-30 |
| CVE-2026-62084 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows... | 2026-09-30 |
| CVE-2026-19743 | high | 7.8 | No | Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 all... | 2026-09-30 |
| CVE-2026-16596 | medium | 6.5 | No | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to,... | 2026-09-30 |
| CVE-2026-14876 | medium | 6.4 | No | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, an... | 2026-09-30 |