Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82182 | medium | 4.1 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using... | 2026-09-03 |
| CVE-2026-16983 | medium | 4.3 | No | The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plainte... | 2026-09-03 |
| CVE-2026-16966 | medium | 5.3 | No | The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing... | 2026-09-03 |
| CVE-2026-15232 | medium | 5.3 | No | The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-su... | 2026-09-03 |
| CVE-2026-14215 | medium | 6.5 | No | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befo... | 2026-09-03 |
| CVE-2026-12865 | high | 7.1 | No | The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute... | 2026-09-03 |
| CVE-2026-12526 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted u... | 2026-09-03 |
| CVE-2026-79991 | not reported | — | No | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager... | 2026-09-03 |
| CVE-2026-79990 | not reported | — | No | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager... | 2026-09-03 |
| CVE-2026-84350 | high | 8.8 | No | Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitr... | 2026-09-03 |
| CVE-2026-84351 | high | 8.3 | No | Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proc... | 2026-09-03 |
| CVE-2026-84354 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exe... | 2026-09-03 |
| CVE-2026-84355 | low | 3.1 | No | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer pro... | 2026-09-03 |
| CVE-2026-80254 | medium | 6.5 | No | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the prod... | 2026-09-03 |
| CVE-2026-80253 | medium | 6.8 | No | An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may... | 2026-09-03 |
| CVE-2026-78080 | not reported | — | No | Joomla Extension - feenders.de - Unauthenticated SQL injection in JooDatabase Lite < 5.1.0 - The cid parameter is used in queries without va... | 2026-09-03 |
| CVE-2026-78069 | not reported | — | No | Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4... | 2026-09-03 |
| CVE-2026-78065 | not reported | — | No | Joomla Extension - j2commerce.com - Guest checkout address disclosure to any authenticated user (IDOR) in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21... | 2026-09-03 |
| CVE-2026-78064 | not reported | — | No | Joomla Extension - j2commerce.com - Anonymous cart-record tampering via inherited FOF `save` task in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1... | 2026-09-03 |
| CVE-2026-78000 | not reported | — | No | Joomla Extension - j2commerce.com - Reflected XSS via `filter_tag`, `pricefrom` and `priceto` in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4... | 2026-09-03 |