Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93344 | medium | 6.5 | No | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action... | 2026-09-22 |
| CVE-2026-93341 | medium | 4.3 | No | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that... | 2026-09-22 |
| CVE-2026-94535 | high | 7.1 | No | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in the deleteMyNotice endpoint that allows authenticated users to d... | 2026-09-22 |
| CVE-2026-94534 | high | 7.1 | No | lamp-cloud through 5.10.0 fails to validate user identity in PUT /anyone/baseInfo and PUT /anyone/avatar endpoints, allowing authenticated a... | 2026-09-22 |
| CVE-2026-94533 | medium | 6.5 | No | lamp-cloud through 5.10.0 contains an authorization bypass vulnerability in FileAnyoneController that allows authenticated users to download... | 2026-09-22 |
| CVE-2026-93873 | medium | 4.3 | No | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the contact plugin submission handler, allowing attackers to forge messages. Att... | 2026-09-22 |
| CVE-2026-93872 | high | 7.5 | No | Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize() without allowed_classes restriction in the comments plugin EditAction.... | 2026-09-22 |
| CVE-2026-93871 | medium | 5.4 | No | Cotonti through 1.0.0 fails to validate redirect destinations in page bodies prefixed with redir:, allowing authenticated users with page cr... | 2026-09-22 |
| CVE-2026-93870 | medium | 4.3 | No | Cotonti through 1.0.0 fails to validate anti-CSRF tokens in the ratings plugin AJAX handler, allowing attackers to forge ratings on behalf o... | 2026-09-22 |
| CVE-2026-93869 | medium | 6.1 | No | Cotonti through 1.0.0 contains an open redirect vulnerability in the cot_url_check() function that validates redirect destinations using a r... | 2026-09-22 |
| CVE-2026-93868 | high | 8.1 | No | Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable tok... | 2026-09-22 |
| CVE-2023-54399 | critical | 9.8 | No | Hongjing e-HR before 8.2 contains a SQL injection vulnerability in the /servlet/codesettree endpoint where the categories query parameter is... | 2026-09-22 |
| CVE-2026-93736 | medium | 4.3 | No | Mealie before 3.21.0 fails to validate user ownership in the ratings and favorites endpoints, allowing authenticated attackers to read any u... | 2026-09-22 |
| CVE-2026-93657 | high | 7.5 | No | hickory-resolver versions before 0.26.2 fail to propagate bogus DNSSEC proof states through the Resolver::lookup() and Resolver::lookup_ip()... | 2026-09-22 |
| CVE-2026-77929 | high | 8.8 | No | ClipBucket v5 before 5.5.3-#182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by upl... | 2026-09-22 |
| CVE-2026-77928 | medium | 6.5 | No | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database c... | 2026-09-22 |
| CVE-2026-77927 | medium | 6.5 | No | ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from... | 2026-09-22 |
| CVE-2026-93456 | high | 8.2 | No | django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge r... | 2026-09-22 |
| CVE-2026-93455 | medium | 6.5 | No | django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitra... | 2026-09-22 |
| CVE-2026-93454 | medium | 5.4 | No | Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated u... | 2026-09-22 |