Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94457 | medium | 4.8 | No | Unauthenticated Bypass Vulnerability in Captcha Code <= 3.32 versions. | 2026-09-23 |
| CVE-2026-94179 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions. | 2026-09-23 |
| CVE-2026-94168 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions. | 2026-09-23 |
| CVE-2026-94118 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions. | 2026-09-23 |
| CVE-2026-93774 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions. | 2026-09-23 |
| CVE-2026-93772 | medium | 6.5 | No | Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions. | 2026-09-23 |
| CVE-2026-93709 | medium | 5.3 | No | Dancer2 versions before 2.2.0 for Perl serve a layout as a page when an equivalent spelling of its path misses the guard in the AutoPage han... | 2026-09-23 |
| CVE-2026-93620 | medium | 6.5 | No | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. | 2026-09-23 |
| CVE-2026-93529 | medium | 6.5 | No | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | 2026-09-23 |
| CVE-2026-93526 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions. | 2026-09-23 |
| CVE-2026-93513 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in SiteSkite <= 2.1.7 versions. | 2026-09-23 |
| CVE-2026-92730 | not reported | — | No | LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV imp... | 2026-09-23 |
| CVE-2026-92692 | not reported | — | No | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.... | 2026-09-23 |
| CVE-2026-92708 | high | 7.5 | No | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1... | 2026-09-23 |
| CVE-2026-90905 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF and Access Control on Site Configuration Update in Easy Store extension 1.0.0-3.0.0 - The e... | 2026-09-23 |
| CVE-2026-90904 | not reported | — | No | Joomla Extension - joomshaper.com - Broken Access Control (ACL Bypass) in ApiController Record Editing in Easy Store extension 1.0.0-3.0.0 -... | 2026-09-23 |
| CVE-2026-90903 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF Token Verification across Administrator AJAX API Endpoints in Easy Store extension 1.0.0-3.... | 2026-09-23 |
| CVE-2026-90900 | not reported | — | No | Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.... | 2026-09-23 |
| CVE-2026-86064 | high | 8.6 | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the default-open GET /log WebSocket route configured... | 2026-09-23 |
| CVE-2026-90899 | not reported | — | No | Joomla Extension - joomshaper.com - Unauthenticated PII Exposure via IDOR in Guest Checkout in Easy Store extension 1.0.0-3.0.0 - The checko... | 2026-09-23 |