Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94679 | medium | 5.4 | No | Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions. | 2026-09-23 |
| CVE-2026-94500 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in ElementsKit Elementor addons Lite <= 4.0.5 versions. | 2026-09-23 |
| CVE-2026-94487 | high | 8.1 | No | Unauthenticated Cross Site Request Forgery (CSRF) in PublishPress Capabilities <= 2.50.1 versions. | 2026-09-23 |
| CVE-2026-94461 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions. | 2026-09-23 |
| CVE-2026-94391 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions. | 2026-09-23 |
| CVE-2026-94176 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions. | 2026-09-23 |
| CVE-2026-94174 | high | 7.6 | No | Administrator SQL Injection in Email Log <= 2.63 versions. | 2026-09-23 |
| CVE-2026-94124 | high | 8.5 | No | Contributor SQL Injection in WP EasyCart <= 5.9.4 versions. | 2026-09-23 |
| CVE-2026-94080 | medium | 5.3 | No | Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions. | 2026-09-23 |
| CVE-2026-94079 | medium | 5.3 | No | Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions. | 2026-09-23 |
| CVE-2026-93773 | high | 8.5 | No | Contributor SQL Injection in Mollie Forms <= 2.11.0 versions. | 2026-09-23 |
| CVE-2026-93623 | medium | 5.3 | No | Unauthenticated Insecure Direct Object References (IDOR) in AI Engine <= 3.7.8 versions. | 2026-09-23 |
| CVE-2026-93622 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions. | 2026-09-23 |
| CVE-2026-93618 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks al... | 2026-09-23 |
| CVE-2026-93527 | high | 8.5 | No | Contributor SQL Injection in Live Copy Paste for Elementor <= 1.5.10 versions. | 2026-09-23 |
| CVE-2026-28666 | high | 8.8 | No | In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check... | 2026-09-23 |
| CVE-2026-28668 | high | 7.8 | No | In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalatio... | 2026-09-23 |
| CVE-2026-28671 | low | 3.3 | No | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local info... | 2026-09-23 |
| CVE-2026-45531 | high | 7.8 | No | In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of... | 2026-09-23 |
| CVE-2026-49879 | high | 8.8 | No | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execu... | 2026-09-23 |