Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-16521 | high | 7.2 | No | An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC fu... | 2026-11-04 |
| CVE-2026-121009 | not reported | — | No | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl skip the injection_guard check for function names given with -func. injecti... | 2026-11-04 |
| CVE-2026-121008 | not reported | — | No | SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profi... | 2026-11-04 |
| CVE-2026-121007 | not reported | — | No | SQL::Abstract versions from 1.90_01 before 2.000001_04 for Perl allow SQL injection via the where values of a nested statement in an identif... | 2026-11-04 |
| CVE-2026-119741 | high | 7.5 | No | rsync before 3.5.2 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious... | 2026-11-04 |
| CVE-2026-119481 | critical | 9.8 | No | Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege Escalation.This issue affects JetF... | 2026-11-04 |
| CVE-2026-119468 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newslett... | 2026-11-04 |
| CVE-2026-119546 | medium | 5.5 | No | Forgejo through 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1 contains a path traversal vulnerability in restore-repo that allow... | 2026-11-04 |
| CVE-2026-119427 | high | 8.8 | No | phpMyAdmin through 5.2.3 contains an sql injection vulnerability in Designer saveSetting() that allows authenticated users to inject SQL via... | 2026-11-04 |
| CVE-2026-119423 | medium | 5.3 | No | OPNsense core before 26.7.8 contains a log injection vulnerability that allows unauthenticated attackers to plant victim IP addresses in the... | 2026-11-04 |
| CVE-2026-119419 | high | 8.1 | No | CakePHP through 5.4.3 contains an sql injection vulnerability that allows attackers to inject SQL by supplying unvalidated collation values... | 2026-11-04 |
| CVE-2026-118983 | medium | 6.8 | No | The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML... | 2026-11-04 |
| CVE-2026-118783 | medium | 6.8 | No | The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting t... | 2026-11-04 |
| CVE-2026-118688 | high | 7.9 | No | wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to rename source paths,... | 2026-11-04 |
| CVE-2026-118637 | low | 2.7 | No | The Simple Download Monitor WordPress plugin before 4.1.3 does not properly check the visibility of the content referenced by one of its sho... | 2026-11-04 |
| CVE-2026-118523 | medium | 5.3 | No | The EventPrime WordPress plugin before 4.3.6.1 does not keep the built-in Pending Review post status non-public, allowing unauthenticated us... | 2026-11-04 |
| CVE-2026-118422 | high | 7.1 | No | The Stape Conversion Tracking WordPress plugin before 2.3.11 does not validate the sub-path appended to its same-origin proxy's upstream end... | 2026-11-04 |
| CVE-2026-118407 | medium | 5.4 | No | The Premium Packages WordPress plugin before 7.3.1 does not verify that a user claiming a guest order is the original buyer, allowing any au... | 2026-11-04 |
| CVE-2026-118404 | medium | 5.3 | No | The Premium Packages WordPress plugin before 7.3.1 does not verify ownership or session binding when loading a previously saved shopping car... | 2026-11-04 |
| CVE-2026-118403 | low | 3.7 | No | The Premium Packages WordPress plugin before 7.3.1 does not verify that the requester owns a guest order before returning its details, allow... | 2026-11-04 |