Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-14565 | medium | 5.4 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popu... | 2026-09-11 |
| CVE-2026-14563 | critical | 9.8 | No | The advanced-customized-prompts WordPress plugin through 1.0.1 does not verify the password before issuing an authenticated session for a su... | 2026-09-11 |
| CVE-2026-14562 | medium | 5.3 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCom... | 2026-09-11 |
| CVE-2026-14560 | critical | 10.0 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied conten... | 2026-09-11 |
| CVE-2026-14559 | critical | 9.8 | No | The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthe... | 2026-09-11 |
| CVE-2026-89173 | medium | 5.3 | No | Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remot... | 2026-09-11 |
| CVE-2026-84960 | medium | 6.1 | No | The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions u... | 2026-09-11 |
| CVE-2026-77150 | medium | 6.1 | No | The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data[name]' Parameter in all... | 2026-09-11 |
| CVE-2026-11446 | medium | 5.3 | No | The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of d... | 2026-09-11 |
| CVE-2026-84890 | medium | 5.9 | No | undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content... | 2026-09-11 |
| CVE-2026-57166 | medium | 5.3 | No | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 4472a31, a stack buffer overflow exists in th... | 2026-09-11 |
| CVE-2026-57165 | medium | 5.3 | No | PJSIP is a free and open source multimedia communication library written in C. Prior to commit 628b716, a stack buffer overflow exists in th... | 2026-09-11 |
| CVE-2026-89179 | medium | 4.3 | No | WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticat... | 2026-09-11 |
| CVE-2026-89178 | high | 8.8 | No | WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attacker... | 2026-09-11 |
| CVE-2026-89177 | high | 8.8 | No | WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on Z... | 2026-09-11 |
| CVE-2026-89176 | high | 8.8 | No | WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated... | 2026-09-11 |
| CVE-2026-89175 | medium | 5.3 | No | Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated re... | 2026-09-11 |
| CVE-2026-89174 | high | 7.5 | No | Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticate... | 2026-09-11 |
| CVE-2026-87122 | not reported | — | No | Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-85984. Reason: This candidate is a reservation duplicat... | 2026-09-11 |
| CVE-2026-73785 | high | 7.5 | No | A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial... | 2026-09-11 |