Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-115426 | medium | 5.5 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.138 does not properly validate a backup storage directory path before... | 2026-11-04 |
| CVE-2026-117472 | medium | 4.3 | No | Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a hard-coded unprefixed... | 2026-11-04 |
| CVE-2026-117471 | medium | 5.4 | No | Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo device and passed it to t... | 2026-11-04 |
| CVE-2026-117470 | medium | 6.5 | No | Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion verification. An unauthenticat... | 2026-11-04 |
| CVE-2026-117469 | medium | 5.4 | No | Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations... | 2026-11-04 |
| CVE-2026-117468 | medium | 6.5 | No | Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming a device code. An aut... | 2026-11-04 |
| CVE-2026-115387 | medium | 6.2 | No | Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 contains a denial of service vulnerability in wasmtime-wasi that all... | 2026-11-04 |
| CVE-2026-115262 | medium | 4.8 | No | The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not restrict its database charset and collat... | 2026-11-04 |
| CVE-2026-115257 | medium | 5.3 | No | The WP Roster WordPress plugin before 2.36 does not perform any capability or nonce checks before writing its stored roster data, allowing u... | 2026-11-04 |
| CVE-2026-115250 | medium | 6.8 | No | The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting... | 2026-11-04 |
| CVE-2026-115383 | medium | 4.8 | No | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains an improper validation vulnerability that accepts components whose core modu... | 2026-11-04 |
| CVE-2026-115379 | medium | 5.7 | No | Wasmtime 47.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a missing GC rooting vulnerability that leaves references live across try_ca... | 2026-11-04 |
| CVE-2026-115243 | medium | 6.7 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not validate the extension of the file it actually stores whe... | 2026-11-04 |
| CVE-2026-115242 | medium | 5.5 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not sanitize the staging destination folder supplied to its s... | 2026-11-04 |
| CVE-2026-115241 | medium | 6.5 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.137 does not verify that a submitted snapshot identifier names a snaps... | 2026-11-04 |
| CVE-2026-115205 | medium | 6.5 | No | The AZEXO Store Locator WordPress plugin through 1.4 does not have a capability check or any authorization control when deleting a post, all... | 2026-11-04 |
| CVE-2026-114431 | medium | 6.4 | No | The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upl... | 2026-11-04 |
| CVE-2026-113934 | high | 7.8 | No | The issue was addressed with improved memory handling. This issue is fixed in macOS Golden Gate 27.2. An app may be able to cause unexpected... | 2026-11-04 |
| CVE-2026-112699 | medium | 6.5 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS 27.... | 2026-11-04 |
| CVE-2026-112695 | medium | 4.3 | No | A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 27.2, iOS 26.7.2 and iPadOS 26.7.2, iOS... | 2026-11-04 |