Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96757 | critical | 9.8 | No | orval before 8.29.0 fails to escape OpenAPI media-type keys when emitting them into single-quoted Content-Type string literals in generated... | 2026-09-23 |
| CVE-2026-95958 | low | 3.3 | No | A security flaw has been discovered in JusticeRage Manalyze 1.0.0. Impacted is the function PE::_parse_relocations of the file manape/pe.cpp... | 2026-09-23 |
| CVE-2026-95927 | high | 7.3 | No | A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /review... | 2026-09-23 |
| CVE-2026-93739 | critical | 9.9 | No | A vulnerability was determined in Totolink A3002MU Hh-B20211125.1046. This impacts the function formWlAc of the file /boafrm/formWlAc. Execu... | 2026-09-23 |
| CVE-2026-93307 | medium | 4.3 | No | A vulnerability has been found in O-RAN-SC SMO OAM 2025-06-10. Affected is an unknown function of the component VES Collector. Such manipula... | 2026-09-23 |
| CVE-2026-18944 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-18944. Reason: This candidate is a reservation duplicat... | 2026-09-23 |
| CVE-2026-78579 | medium | 6.5 | No | The Okta Access Gateway does not sanitize SAML assertion attribute values before interpolating them into LDAP search filters in the LDAP dat... | 2026-09-23 |
| CVE-2026-80047 | high | 7.8 | No | A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user... | 2026-09-23 |
| CVE-2026-96755 | critical | 9.8 | No | orval versions 8.14.0 through 8.28.1 contain a code injection vulnerability in the @orval/effect generator that converts OpenAPI schema defa... | 2026-09-23 |
| CVE-2026-87978 | medium | 5.3 | No | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on one branch of its payment webhook, allowi... | 2026-09-23 |
| CVE-2026-87848 | low | 3.7 | No | The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions availabl... | 2026-09-23 |
| CVE-2026-87071 | medium | 5.3 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclu... | 2026-09-23 |
| CVE-2026-87070 | medium | 5.3 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not verify that a request came from a trusted proxy before preferring client-supp... | 2026-09-23 |
| CVE-2026-86612 | medium | 5.6 | No | The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-d... | 2026-09-23 |
| CVE-2026-86604 | medium | 4.8 | No | The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in... | 2026-09-23 |
| CVE-2026-86601 | medium | 6.5 | No | The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page... | 2026-09-23 |
| CVE-2026-87074 | low | 3.7 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and t... | 2026-09-23 |
| CVE-2026-87069 | low | 3.1 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time paym... | 2026-09-23 |
| CVE-2026-86842 | medium | 6.8 | No | The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actio... | 2026-09-23 |
| CVE-2026-86783 | medium | 5.3 | No | The Post Grid Gutenberg Blocks WordPress plugin before 5.0.41 does not perform an authorization or post-visibility check on a REST API route... | 2026-09-23 |