Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96552 | low | 3.1 | No | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function M... | 2026-09-24 |
| CVE-2026-82409 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts pla... | 2026-09-24 |
| CVE-2026-82406 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/mark... | 2026-09-24 |
| CVE-2026-82405 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes... | 2026-09-24 |
| CVE-2026-63203 | high | 7.6 | No | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/co... | 2026-09-24 |
| CVE-2026-61570 | high | 7.5 | No | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, Merlin... | 2026-09-24 |
| CVE-2026-4806 | medium | 6.5 | No | The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capabi... | 2026-09-24 |
| CVE-2026-18335 | medium | 5.4 | No | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in a... | 2026-09-24 |
| CVE-2026-18467 | critical | 9.8 | No | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin... | 2026-09-24 |
| CVE-2026-12227 | critical | 9.8 | No | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0... | 2026-09-24 |
| CVE-2026-93760 | high | 8.2 | No | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-b... | 2026-09-24 |
| CVE-2026-93761 | high | 7.5 | No | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent... | 2026-09-24 |
| CVE-2026-93762 | critical | 9.8 | No | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl... | 2026-09-24 |
| CVE-2026-93763 | medium | 6.5 | No | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl... | 2026-09-24 |
| CVE-2026-93764 | medium | 6.5 | No | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl... | 2026-09-24 |
| CVE-2026-11538 | medium | 5.3 | No | IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. | 2026-09-24 |
| CVE-2026-45528 | high | 7.3 | No | In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This... | 2026-09-24 |
| CVE-2026-49895 | low | 3.5 | No | In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This cou... | 2026-09-24 |
| CVE-2026-49918 | high | 7.8 | No | In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege... | 2026-09-24 |
| CVE-2026-49919 | high | 7.8 | No | In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local esca... | 2026-09-24 |