Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95626 | high | 8.3 | No | Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an appli... | 2026-09-23 |
| CVE-2026-95625 | medium | 5.9 | No | The Tauri updater plugin verifies update binaries using minisign signatures, but the signature covers only the raw binary bytes. The update... | 2026-09-23 |
| CVE-2026-28664 | high | 7.8 | No | In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escal... | 2026-09-23 |
| CVE-2026-6669 | medium | 5.9 | No | Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25... | 2026-09-23 |
| CVE-2026-6668 | high | 7.5 | No | Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial o... | 2026-09-23 |
| CVE-2026-19888 | high | 7.5 | No | Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated r... | 2026-09-23 |
| CVE-2026-96548 | medium | 5.6 | No | A flaw has been found in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. This affects an unknown part of the file ssm_pr... | 2026-09-23 |
| CVE-2026-95604 | high | 7.5 | No | Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions. | 2026-09-23 |
| CVE-2026-95602 | medium | 6.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in YITH YITH WooCommerce Request A Quote allows Exploiting Incorrectly Config... | 2026-09-23 |
| CVE-2026-95601 | critical | 9.3 | No | Unauthenticated SQL Injection in Product Filter by WBW <= 3.1.7 versions. | 2026-09-23 |
| CVE-2026-95593 | high | 7.6 | No | Editor SQL Injection in Ultimeter <= 3.0.8 versions. | 2026-09-23 |
| CVE-2026-95590 | high | 7.1 | No | Subscriber SQL Injection in Tainacan <= 1.2.0 versions. | 2026-09-23 |
| CVE-2026-95586 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <= 3.5.50 versions. | 2026-09-23 |
| CVE-2026-95529 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Calculated Fields Form <= 5.5.1.1 versions. | 2026-09-23 |
| CVE-2026-95527 | medium | 6.5 | No | Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | 2026-09-23 |
| CVE-2026-95525 | medium | 6.5 | No | Subscriber Arbitrary File Deletion in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95523 | medium | 6.5 | No | Subscriber Bypass Vulnerability in WP User Frontend <= 4.3.11 versions. | 2026-09-23 |
| CVE-2026-95515 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms <= 3.15.3 versions. | 2026-09-23 |
| CVE-2026-95514 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions. | 2026-09-23 |
| CVE-2026-94680 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in The Post Grid <= 7.9.5 versions. | 2026-09-23 |