Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106000 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.34 does not require payment to be completed before saving a booking on calendars configured... | 2026-11-04 |
| CVE-2026-105413 | high | 7.5 | No | The Form Maker by 10Web WordPress plugin before 1.15.51 does not consistently escape user-submitted field values before rendering them on it... | 2026-11-04 |
| CVE-2026-105981 | high | 7.2 | No | Improper input validation in the Digital I/O function may allow a remote attacker with high privileges to inject operating system commands a... | 2026-11-04 |
| CVE-2026-105993 | medium | 5.3 | No | The DT Directory Lite Addon WordPress plugin through 1.1 does not perform nonce or capability checks on its settings handlers, allowing unau... | 2026-11-04 |
| CVE-2026-105967 | medium | 5.8 | No | The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-sid... | 2026-11-04 |
| CVE-2026-105946 | not reported | — | No | Out-of-bounds read in the QAuthenticator NTLM authentication handling in the Qt Network module in Qt Group Qt allows remote attackers to obt... | 2026-11-04 |
| CVE-2026-105191 | medium | 4.3 | No | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce WordPress plugin before 1.17.11 does not perform a capability check on an... | 2026-11-04 |
| CVE-2026-104719 | medium | 6.4 | No | The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not saniti... | 2026-11-04 |
| CVE-2026-104648 | medium | 4.9 | No | The weMail WordPress plugin through 2.1.6 does not restrict a site-wide third-party email-service API key to administrators, exposing it in... | 2026-11-04 |
| CVE-2026-104647 | low | 3.8 | No | The weMail WordPress plugin through 2.1.6 does not correctly verify user capabilities in its REST API permission checks, treating any user w... | 2026-11-04 |
| CVE-2026-103379 | medium | 5.3 | No | The WATI Chat and Notification WordPress plugin through 1.1.8 does not require a valid, non-empty secret on a public endpoint that returns i... | 2026-11-04 |
| CVE-2026-101166 | low | 3.7 | No | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify a product's publication status before creating an order fo... | 2026-11-04 |
| CVE-2026-101165 | low | 3.7 | No | The Mollie Payments for WooCommerce WordPress plugin before 8.2.0 does not verify an order's payment state or the requested payment gateway... | 2026-11-04 |
| CVE-2026-102787 | not reported | — | No | Joomla Extension - phoca.cz - CSRF in category management in Phoca Download 3.1.0 - 6.1.5 | 2026-11-04 |
| CVE-2026-101034 | not reported | — | No | An attacker who obtained the hardcoded key could decrypt domain/service account passwords, task run-as credentials, and sysprep passwords st... | 2026-11-04 |
| CVE-2026-100408 | medium | 4.4 | No | Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows... | 2026-11-04 |
| CVE-2026-100407 | medium | 4.4 | No | Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in cont... | 2026-11-04 |
| CVE-2024-7631 | medium | 4.3 | No | A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This e... | 2026-11-04 |
| CVE-2026-116882 | medium | 4.8 | No | Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated profile or schema... | 2026-11-04 |
| CVE-2026-91424 | medium | 6.4 | No | Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure). Supported versions that are affe... | 2026-11-04 |