Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15823 | medium | 4.3 | No | The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t... | 2026-09-11 |
| CVE-2026-19797 | medium | 6.1 | No | The User Access Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab_group_section' parameter in all ve... | 2026-09-11 |
| CVE-2026-15406 | high | 7.5 | No | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion... | 2026-09-11 |
| CVE-2026-62139 | medium | 4.3 | No | Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0 versions. | 2026-09-11 |
| CVE-2026-62138 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.1 versions. | 2026-09-11 |
| CVE-2026-62134 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in Starter Templates <= 4.7.5 versions. | 2026-09-11 |
| CVE-2026-62133 | medium | 5.4 | No | Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. | 2026-09-11 |
| CVE-2026-62112 | high | 7.6 | No | Editor SQL Injection in Amelia <= 2.4.9 versions. | 2026-09-11 |
| CVE-2026-62111 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Simple Payment <= 2.5.4 versions. | 2026-09-11 |
| CVE-2026-62106 | high | 8.8 | No | Subscriber Privilege Escalation in SMS Alert Order Notifications <= 3.9.9 versions. | 2026-09-11 |
| CVE-2026-62105 | critical | 9.8 | No | Unauthenticated PHP Object Injection in ThemeREX Addons < 2.45.0 versions. | 2026-09-11 |
| CVE-2026-27378 | medium | 5.3 | No | Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. | 2026-09-11 |
| CVE-2026-84651 | medium | 6.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the REST API and CLI endpoints for updating agent configuration do not prevent a subm... | 2026-09-11 |
| CVE-2026-84650 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, transient fields cannot be excluded from deserialization, allowing attackers able to... | 2026-09-11 |
| CVE-2026-84646 | medium | 4.3 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, user objects can appear as nested field values in other deserialized XML objects, all... | 2026-09-11 |
| CVE-2026-84645 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, objects of types marked as storing their configuration in independent top-level confi... | 2026-09-11 |
| CVE-2026-84648 | high | 8.8 | No | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the system log viewer does not escape log record metadata (source, level, and timesta... | 2026-09-11 |
| CVE-2026-70334 | high | 7.8 | No | Incomplete list of disallowed inputs in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 2026-09-11 |
| CVE-2026-78461 | high | 7.4 | No | Improper limitation of a pathname to a restricted directory ('path traversal') in Visual Studio Code allows an unauthorized attacker to bypa... | 2026-09-11 |
| CVE-2026-78462 | high | 8.8 | No | Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature over a n... | 2026-09-11 |