Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-120524 | medium | 6.4 | No | The News Kit Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'formData' parameter in all vers... | 2026-11-03 |
| CVE-2026-120330 | not reported | — | No | Backend actions and ajax routes of the mail module do not check whether the backend user has access to the page of the requested mail or rec... | 2026-11-03 |
| CVE-2026-120329 | not reported | — | No | Saving the configuration of the mail backend module writes submitted settings to the page TSconfig without restricting them to the configura... | 2026-11-03 |
| CVE-2026-120328 | not reported | — | No | The click tracking middleware does not validate the authentication code of a recipient if the code is omitted. Unauthenticated attackers can... | 2026-11-03 |
| CVE-2026-120327 | not reported | — | No | The click tracking middleware accepts an arbitrary target URL and redirects to it. Attackers can misuse links to the website to redirect use... | 2026-11-03 |
| CVE-2026-119179 | high | 7.0 | No | A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while da... | 2026-11-03 |
| CVE-2026-119740 | medium | 6.8 | No | Nexbox A95X TV boxes built on the Amlogic S905X platform contain an unauthenticated console exposed via an internal UART header on the PCB t... | 2026-11-03 |
| CVE-2026-119732 | medium | 6.5 | No | Munshi (by Petpooja) before 2026-07-28 contained a broken object level authorization vulnerability that allows authenticated sub-users to de... | 2026-11-03 |
| CVE-2026-119166 | medium | 5.3 | No | The Welcart e-Commerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.12.5 v... | 2026-11-03 |
| CVE-2026-118489 | high | 7.5 | No | In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a... | 2026-11-03 |
| CVE-2026-118448 | not reported | — | No | A use of uninitialized memory vulnerability in the pybddisasm Python bindings affects nd_to_text. If the underlying text conversion fails, i... | 2026-11-03 |
| CVE-2026-118447 | not reported | — | No | A use of uninitialized memory vulnerability in the pybddisasm Python bindings may disclose process memory when instruction decoding fails. T... | 2026-11-03 |
| CVE-2026-118446 | not reported | — | No | A use-after-free vulnerability in the pybddisasm Python bindings affects array-valued members of INSTRUX objects, including ND_OPERAND array... | 2026-11-03 |
| CVE-2026-114582 | medium | 5.3 | No | An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. `django.contrib.gis.gdal.SpatialReference` (an... | 2026-11-03 |
| CVE-2026-113733 | low | 2.2 | No | An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The `django.contrib.admin.utils.display_for_field()` function did... | 2026-11-03 |
| CVE-2026-118445 | not reported | — | No | A use-after-free vulnerability in the pybddisasm Python bindings affects structure-valued members of INSTRUX objects. These members are expo... | 2026-11-03 |
| CVE-2026-118444 | not reported | — | No | Out-of-bounds read vulnerabilities in the pybddisasm Python bindings may disclose adjacent process memory during instruction decoding. The n... | 2026-11-03 |
| CVE-2026-113901 | medium | 4.3 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 27.2 and iPadOS 27.2, macOS Go... | 2026-11-03 |
| CVE-2026-113593 | low | 3.1 | No | An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The `django.middleware.cache.UpdateCacheMiddle... | 2026-11-03 |
| CVE-2026-112691 | medium | 5.5 | No | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and... | 2026-11-03 |