Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79721 | not reported | — | No | Code execution can occur in versions of the MLflow platform running version 0.0.1 or newer, enabling a maliciously crafted model artifact to... | 2026-09-09 |
| CVE-2026-67402 | not reported | — | No | An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual ho... | 2026-09-09 |
| CVE-2026-79989 | not reported | — | No | The vulnerability allows any authenticated user to change their own password without providing the current password or having an active elev... | 2026-09-09 |
| CVE-2026-67395 | medium | 5.9 | No | A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path para... | 2026-09-09 |
| CVE-2026-12858 | not reported | — | No | Improper Privilege Management vulnerability in ESET AV Remover (standalone) allows Privilege Escalation via especially crafted RPC. | 2026-09-09 |
| CVE-2026-87827 | not reported | — | No | Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring... | 2026-09-09 |
| CVE-2026-78377 | medium | 6.1 | No | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Syst... | 2026-09-09 |
| CVE-2026-19733 | medium | 5.3 | No | Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and... | 2026-09-09 |
| CVE-2026-11838 | medium | 4.3 | No | Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind... | 2026-09-09 |
| CVE-2026-76801 | high | 8.8 | No | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code... | 2026-09-09 |
| CVE-2026-13709 | medium | 6.4 | No | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_tem... | 2026-09-09 |
| CVE-2026-12956 | medium | 5.3 | No | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the... | 2026-09-09 |
| CVE-2026-86806 | high | 7.3 | No | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-... | 2026-09-09 |
| CVE-2026-14989 | high | 7.2 | No | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_... | 2026-09-09 |
| CVE-2026-19778 | medium | 6.5 | No | The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQ... | 2026-09-09 |
| CVE-2026-84908 | medium | 5.3 | No | The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plug... | 2026-09-09 |
| CVE-2026-76009 | high | 8.1 | No | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin... | 2026-09-09 |
| CVE-2026-19945 | medium | 6.4 | No | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to,... | 2026-09-09 |
| CVE-2026-84293 | high | 7.2 | No | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field V... | 2026-09-09 |
| CVE-2026-7804 | medium | 6.1 | No | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter i... | 2026-09-09 |