Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-18595 | high | 7.2 | No | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all... | 2026-09-16 |
| CVE-2026-19655 | medium | 6.5 | No | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information opti... | 2026-09-16 |
| CVE-2026-19729 | medium | 4.9 | No | A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak.... | 2026-09-16 |
| CVE-2026-14349 | critical | 9.8 | No | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to,... | 2026-09-16 |
| CVE-2026-15609 | medium | 6.4 | No | The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortc... | 2026-09-16 |
| CVE-2026-15402 | medium | 6.4 | No | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scr... | 2026-09-16 |
| CVE-2026-11996 | medium | 6.4 | No | The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions u... | 2026-09-16 |
| CVE-2026-11984 | medium | 5.3 | No | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,... | 2026-09-16 |
| CVE-2026-68534 | not reported | — | No | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scrip... | 2026-09-16 |
| CVE-2026-68533 | not reported | — | No | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message A... | 2026-09-16 |
| CVE-2026-68531 | not reported | — | No | Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders... | 2026-09-16 |
| CVE-2026-68530 | not reported | — | No | Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. T... | 2026-09-16 |
| CVE-2026-68529 | not reported | — | No | Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_se... | 2026-09-16 |
| CVE-2026-18421 | not reported | — | No | Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update... | 2026-09-16 |
| CVE-2026-81899 | not reported | — | No | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page... | 2026-09-16 |
| CVE-2026-18115 | not reported | — | No | Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.... | 2026-09-16 |
| CVE-2026-78547 | not reported | — | No | Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2... | 2026-09-16 |
| CVE-2026-78546 | not reported | — | No | Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current... | 2026-09-16 |
| CVE-2026-89160 | medium | 6.5 | No | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. | 2026-09-16 |
| CVE-2026-27562 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT re... | 2026-09-16 |