Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84769 | medium | 6.5 | No | Unauthenticated Insecure Direct Object References (IDOR) in Business Directory <= 6.4.26 versions. | 2026-09-07 |
| CVE-2026-84763 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in RTMKit <= 2.1.5 versions. | 2026-09-07 |
| CVE-2026-84756 | high | 7.1 | No | Subscriber Privilege Escalation in WCFM Membership <= 2.11.11 versions. | 2026-09-07 |
| CVE-2026-84238 | critical | 9.8 | No | Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. | 2026-09-07 |
| CVE-2026-81295 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Under Construction <= 5.82 versions. | 2026-09-07 |
| CVE-2026-27086 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Xtemos WoodMart allows DOM-Based XSS.... | 2026-09-07 |
| CVE-2026-11613 | critical | 9.8 | No | The Divi Ajax Filter plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.1.2 via the 'custom_... | 2026-09-07 |
| CVE-2026-85225 | high | 7.3 | No | A vulnerability was identified in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient_... | 2026-09-05 |
| CVE-2026-85207 | low | 3.5 | No | A vulnerability was identified in itsourcecode Online Medicine Delivery System 1.0. Impacted is an unknown function of the file /index.php?q... | 2026-09-05 |
| CVE-2026-85309 | medium | 5.3 | No | Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security... | 2026-09-05 |
| CVE-2026-85305 | medium | 5.4 | No | Server-Side Request Forgery (SSRF) vulnerability in SEOPress allows Server Side Request Forgery. This issue affects SEOPress: from n/a thro... | 2026-09-05 |
| CVE-2026-84847 | high | 7.5 | No | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. | 2026-09-05 |
| CVE-2026-84812 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.27 versions. | 2026-09-05 |
| CVE-2026-84774 | medium | 6.1 | No | Unauthenticated Cross Site Scripting (XSS) in WP Statistics <= 14.16.11 versions. | 2026-09-05 |
| CVE-2026-84766 | medium | 5.9 | No | Unauthenticated Bypass Vulnerability in FluentBooking Pro <= 2.2.1 versions. | 2026-09-05 |
| CVE-2026-84758 | medium | 6.5 | No | Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. | 2026-09-05 |
| CVE-2026-84753 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Mail Mint <= 1.31.0 versions. | 2026-09-05 |
| CVE-2026-85137 | high | 7.3 | No | A security vulnerability has been detected in SeaCMS up to 13.6. This impacts the function parseIf of the file seacms_locoy_news.php of the... | 2026-09-05 |
| CVE-2026-85106 | medium | 6.3 | No | A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap... | 2026-09-05 |
| CVE-2026-81773 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ninja Forms File Uploads Extension <= 3.3.26 versions. | 2026-09-05 |