Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-76178 | not reported | — | No | A stored Cross-Site Scripting (XSS) vulnerability in the notification template functionality of the endpoint /ocsreports/?function=notificat... | 2026-09-03 |
| CVE-2026-76177 | not reported | — | No | Server-Side Request Forgery (SSRF) vulnerability in the /ocsreports/?function=tele_activate endpoint due to insufficient validation of the H... | 2026-09-03 |
| CVE-2026-76176 | not reported | — | No | SQL injection vulnerability in the endpoint /ocsreports/index.php?function=admin_double due to improper processing of the values in the ID f... | 2026-09-03 |
| CVE-2026-76175 | not reported | — | No | SQL injection vulnerability in the del_check parameter of the /ocsreports/?function=save_query_list endpoint. Input provided by an authentic... | 2026-09-03 |
| CVE-2026-76174 | not reported | — | No | Unrestricted file upload vulnerability in the CSV file upload functionality of the Ocsreports admin_info endpoint. The application validates... | 2026-09-03 |
| CVE-2026-6071 | not reported | — | No | A remote code execution security issue exists in the affected products when parsing DOE files that could allow a remote attacker to write pa... | 2026-09-03 |
| CVE-2026-82968 | medium | 6.4 | No | A flaw was found in the first-broker-login flow of the Keycloak identity management service. When a user links a social identity provider ac... | 2026-09-03 |
| CVE-2021-43614 | medium | 6.7 | No | Error in handling the PlatformLangCodes UEFI variable could cause a buffer overflow, leading to resource exhaustion and failure. | 2026-09-03 |
| CVE-2021-43613 | medium | 6.5 | No | An issue was discovered in SysPasswordDxe in Insyde InsydeH2O. User and administrator password hashes are exposed in runtime UEFI variables,... | 2026-09-03 |
| CVE-2021-38489 | high | 8.2 | No | HDD password plaintext is stored in a UEFI variable. | 2026-09-03 |
| CVE-2026-82293 | medium | 4.3 | No | Incorrect Authorization (CWE-863) in the Kibana machine learning feature can lead to unauthorized resource consumption via Exploiting Incorr... | 2026-09-03 |
| CVE-2026-8151 | medium | 5.4 | No | The Simple Membership MailChimp Integration WordPress plugin before 1.9.8 does not have CSRF checks in its settings page, allowing attackers... | 2026-09-03 |
| CVE-2026-83547 | medium | 6.8 | No | The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attr... | 2026-09-03 |
| CVE-2026-83533 | medium | 5.3 | No | The WP Express Checkout WordPress plugin before 2.4.9 does not verify server-side that a payment was actually completed before marking an or... | 2026-09-03 |
| CVE-2026-82884 | medium | 6.8 | No | The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the... | 2026-09-03 |
| CVE-2026-81571 | medium | 4.8 | No | The Brave WordPress plugin before 0.8.8 does not prevent a URL parameter used to pre-fill a form field from being passed to WordPress's shor... | 2026-09-03 |
| CVE-2026-78153 | medium | 5.3 | No | The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conte... | 2026-09-03 |
| CVE-2026-77794 | medium | 5.3 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate a client-supplied quantity multiplier when calculating the total pri... | 2026-09-03 |
| CVE-2026-77793 | medium | 5.3 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not validate the total price of a paid registration server-side, allowing unauthe... | 2026-09-03 |
| CVE-2026-77009 | critical | 9.9 | No | The WatchMan-Site7 WordPress plugin through 4.2.0 does not restrict access to its debugging console, which executes user-supplied PHP code,... | 2026-09-03 |