Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-84729 | not reported | — | No | Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the intended buffer or pot... | 2026-11-04 |
| CVE-2026-59263 | medium | 5.5 | No | A manipulated document opened in Apache OpenOffice 4.1.16 or earlier may allow substituted content to be displayed manipulating the user. Su... | 2026-11-04 |
| CVE-2026-62126 | high | 7.5 | No | Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On miniorange-saml-20-single-sign-on al... | 2026-11-04 |
| CVE-2026-62007 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements... | 2026-11-04 |
| CVE-2026-57775 | medium | 5.3 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile all... | 2026-11-04 |
| CVE-2026-62000 | high | 7.5 | No | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access... | 2026-11-04 |
| CVE-2026-64750 | medium | 5.5 | No | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27 and iP... | 2026-11-04 |
| CVE-2026-42965 | medium | 6.5 | No | A flaw was found in the OpenShift Router. A user with EndpointSlice write access can exploit this vulnerability by creating a Service backed... | 2026-11-04 |
| CVE-2026-57666 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area c... | 2026-11-04 |
| CVE-2026-57639 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booki... | 2026-11-04 |
| CVE-2026-56065 | high | 7.5 | No | Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder for WooCommerce doofind... | 2026-11-04 |
| CVE-2026-54861 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area c... | 2026-11-04 |
| CVE-2026-54851 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms... | 2026-11-04 |
| CVE-2026-119477 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus... | 2026-11-04 |
| CVE-2026-118624 | medium | 5.4 | No | MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclo... | 2026-11-04 |
| CVE-2026-117553 | high | 7.5 | No | Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to register attac... | 2026-11-04 |
| CVE-2026-116891 | medium | 6.1 | No | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to i... | 2026-11-04 |
| CVE-2026-116879 | medium | 5.4 | No | Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with... | 2026-11-04 |
| CVE-2026-116739 | medium | 4.3 | No | VMime through 0.9.2 contains an information disclosure vulnerability in the uuEncoder::decode function that writes uninitialized stack memor... | 2026-11-04 |
| CVE-2026-116489 | high | 7.5 | No | Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by... | 2026-11-04 |