Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62078 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | 2026-09-30 |
| CVE-2026-27371 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions. | 2026-09-30 |
| CVE-2026-27085 | low | 2.7 | No | Shop manager Content Injection in Astra WordPress Theme <= 4.13.12 versions. | 2026-09-30 |
| CVE-2026-103117 | medium | 4.7 | No | A security vulnerability has been detected in OS4ED openSIS-Classic up to 9.3. Affected is the function db_properties of the file functions/... | 2026-09-30 |
| CVE-2026-103114 | medium | 6.3 | No | A vulnerability was identified in OS4ED openSIS-Classic up to 9.3. The impacted element is the function DBQuery_assignment of the file modul... | 2026-09-30 |
| CVE-2026-103041 | critical | 9.8 | No | LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization enabled on all interf... | 2026-09-30 |
| CVE-2026-102912 | medium | 4.7 | No | A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file... | 2026-09-30 |
| CVE-2026-102909 | high | 7.3 | No | A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewe... | 2026-09-30 |
| CVE-2026-102874 | high | 7.3 | No | A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of t... | 2026-09-30 |
| CVE-2026-102399 | medium | 5.4 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Photo Gallery by Supsystic <= 1.21.0 versions. | 2026-09-30 |
| CVE-2026-102398 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Popup by Supsystic <= 1.13.1 versions. | 2026-09-30 |
| CVE-2026-102396 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic <= 1.5.5 versions. | 2026-09-30 |
| CVE-2026-102395 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Easy Google Maps <= 1.14.6 versions. | 2026-09-30 |
| CVE-2026-102386 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.003 versions. | 2026-09-30 |
| CVE-2026-102845 | medium | 5.3 | No | A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affe... | 2026-09-30 |
| CVE-2026-102842 | medium | 6.3 | No | A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is t... | 2026-09-30 |
| CVE-2026-102794 | critical | 9.1 | No | A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Su... | 2026-09-30 |
| CVE-2026-102385 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | 2026-09-30 |
| CVE-2026-102384 | medium | 5.9 | No | Author Cross Site Scripting (XSS) in Supreme Modules Lite <= 2.5.63 versions. | 2026-09-30 |
| CVE-2026-102006 | medium | 5.5 | No | In Wind River VxWorks 7 prior to 26.09, specific system call arguments can result in the process management subsystem failing to properly re... | 2026-09-30 |