Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-78362 | critical | 9.8 | No | The SEO Flow by LupsOnline WordPress plugin before 3.0.3 does not correctly validate the credential supplied with its API requests, allowing... | 2026-09-08 |
| CVE-2026-78150 | low | 2.7 | No | The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing use... | 2026-09-08 |
| CVE-2026-78149 | medium | 5.3 | No | The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its stored... | 2026-09-08 |
| CVE-2026-77826 | high | 8.8 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepti... | 2026-09-08 |
| CVE-2026-19861 | medium | 4.7 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value... | 2026-09-08 |
| CVE-2026-19858 | high | 7.5 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving reques... | 2026-09-08 |
| CVE-2026-15247 | medium | 5.4 | No | The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one... | 2026-09-08 |
| CVE-2026-85541 | medium | 5.4 | No | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary J... | 2026-09-08 |
| CVE-2026-85540 | high | 8.8 | No | DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to rea... | 2026-09-08 |
| CVE-2026-84043 | medium | 5.3 | No | The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation r... | 2026-09-08 |
| CVE-2026-82923 | critical | 9.8 | No | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allow... | 2026-09-08 |
| CVE-2026-85149 | medium | 5.3 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85148 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can explo... | 2026-09-08 |
| CVE-2026-85147 | high | 7.5 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85146 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-78234 | critical | 9.9 | No | A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace... | 2026-09-08 |
| CVE-2026-77968 | high | 8.2 | No | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh... | 2026-09-08 |
| CVE-2026-75021 | high | 8.1 | No | fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the... | 2026-09-08 |
| CVE-2026-82325 | not reported | — | No | A use-after-free vulnerability in the OpenVPN ovpn-dco-win driver version 2.5.0 through 2.8.6 allows local authenticated users to cause a sy... | 2026-09-08 |
| CVE-2026-84732 | not reported | — | No | Retransmissions of ACK packet ID in OpenVPN through 2.6.22 and 2.7.6 allow remote unauthenticated attackers to cause a denial of service via... | 2026-09-08 |