Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77186 | medium | 6.4 | No | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attrib... | 2026-09-09 |
| CVE-2026-19944 | medium | 4.9 | No | The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and incl... | 2026-09-09 |
| CVE-2026-17553 | high | 7.2 | No | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_aj... | 2026-09-09 |
| CVE-2026-86347 | medium | 6.5 | No | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploa... | 2026-09-09 |
| CVE-2026-86351 | medium | 6.1 | No | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is in... | 2026-09-09 |
| CVE-2026-86408 | medium | 6.5 | No | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()... | 2026-09-09 |
| CVE-2026-86417 | medium | 4.3 | No | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetch... | 2026-09-09 |
| CVE-2026-86419 | critical | 9.1 | No | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fu... | 2026-09-09 |
| CVE-2026-86440 | medium | 5.4 | No | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is store... | 2026-09-09 |
| CVE-2026-86441 | medium | 4.3 | No | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several... | 2026-09-09 |
| CVE-2026-86451 | medium | 4.3 | No | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data(... | 2026-09-09 |
| CVE-2026-86342 | medium | 4.3 | No | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlatio... | 2026-09-09 |
| CVE-2026-86544 | high | 8.1 | No | knowns versions before 0.30.0 contain an authorization bypass vulnerability where mutating code actions are incorrectly classified as read-o... | 2026-09-09 |
| CVE-2026-86539 | high | 7.2 | No | knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbo... | 2026-09-09 |
| CVE-2026-86436 | medium | 5.4 | No | Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts... | 2026-09-09 |
| CVE-2026-86319 | medium | 5.3 | No | A vulnerability has been found in java-json-tools json-patch up to 1.13. Affected by this vulnerability is the function JsonPatch.apply of t... | 2026-09-09 |
| CVE-2026-86308 | medium | 5.3 | No | A vulnerability was detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This issue... | 2026-09-09 |
| CVE-2026-86302 | medium | 5.3 | No | A vulnerability was found in code-projects Hospital Information System 1.0. Affected by this vulnerability is an unknown functionality of th... | 2026-09-09 |
| CVE-2026-86297 | high | 8.1 | No | A vulnerability was identified in D-Link DIR-605 B1v202WWB03. This issue affects the function tunnel_set_params of the file progs.gpl/pppd.a... | 2026-09-09 |
| CVE-2026-86292 | high | 7.3 | No | A vulnerability was detected in SourceCodester Simple Traffic Offense System 1.0. Affected is an unknown function of the file saveuser.php o... | 2026-09-09 |