Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111962 | low | 3.7 | No | The WP Remote Users Sync WordPress plugin before 2.2.0 does not adequately restrict access to the user export files it writes beneath the pu... | 2026-11-04 |
| CVE-2026-111740 | low | 2.7 | No | The Post Duplicator WordPress plugin before 3.0.17 does not check whether the requesting user may view each post before returning a list of... | 2026-11-04 |
| CVE-2026-112464 | high | 7.8 | No | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and... | 2026-11-04 |
| CVE-2026-112425 | low | 3.3 | No | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 26.7.2 and iPadOS 26.7.2, iOS 27.2 and iPadOS... | 2026-11-04 |
| CVE-2026-110964 | medium | 6.5 | No | The Essential Real Estate WordPress plugin before 5.3.5 does not verify that a media attachment belongs to the requesting user before deleti... | 2026-11-04 |
| CVE-2026-111461 | not reported | — | No | An OS command injection vulnerability exists in OnCell G3150A-LTE Series. When the SMS management functionality is enabled and configured, a... | 2026-11-04 |
| CVE-2026-111460 | not reported | — | No | A hard-coded cryptographic key vulnerability exists in the OnCell G3150A-LTE Series. Under certain conditions, an unauthenticated remote att... | 2026-11-04 |
| CVE-2026-111459 | not reported | — | No | An improper certificate validation vulnerability exists in Moxa Remote Connect Suite (MRC Client). Under certain conditions, an unauthentica... | 2026-11-04 |
| CVE-2026-110910 | low | 3.7 | No | ### Summary `qs.stringify` with `allowEmptyArrays: true` writes the key of an empty array without encoding it, even though keys are encoded... | 2026-11-04 |
| CVE-2026-110692 | medium | 4.1 | No | The PowerPack Addons for Elementor: Widgets, Form Styler and Templates WordPress plugin before 3.1.3 does not validate a user-supplied URL b... | 2026-11-04 |
| CVE-2026-108068 | low | 3.8 | No | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform proper authorization checks on one of its video-migratio... | 2026-11-04 |
| CVE-2026-108067 | low | 3.8 | No | The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not properly verify record ownership before modifying or deleting st... | 2026-11-04 |
| CVE-2026-108041 | high | 7.1 | No | The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an... | 2026-11-04 |
| CVE-2026-110540 | high | 7.1 | No | Dell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.1... | 2026-11-04 |
| CVE-2026-106649 | medium | 6.8 | No | The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and abo... | 2026-11-04 |
| CVE-2026-106004 | medium | 5.3 | No | The DT LMS WordPress plugin through 1.2 does not perform capability or nonce checks on one of its AJAX actions, allowing unauthenticated att... | 2026-11-04 |
| CVE-2026-107147 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the l... | 2026-11-04 |
| CVE-2026-107146 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of ser... | 2026-11-04 |
| CVE-2026-107145 | not reported | — | No | The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting... | 2026-11-04 |
| CVE-2026-107472 | not reported | — | No | An out-of-bounds read vulnerability in the QTextCodec TSCII encoding of the Qt 5 Compatibility APIs module (Qt Core in Qt 5 and earlier) imp... | 2026-11-04 |