Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-119649 | high | 7.1 | No | Orchard CMS 1.10.3 through 1.11 contains an improper authorization vulnerability in MediaLibraryService.CheckMediaFolderPermission() that al... | 2026-10-30 |
| CVE-2026-119646 | medium | 4.3 | No | Open Web Analytics before 1.14.1 contains an authorization vulnerability that allows authenticated users to read other sites' report data be... | 2026-10-30 |
| CVE-2026-119645 | medium | 6.5 | No | ZenTao PMS through 22.6 contains a missing authorization vulnerability in doc::ajaxGetDoc() that allows authenticated users to read document... | 2026-10-30 |
| CVE-2010-20125 | high | 7.5 | No | DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control... | 2026-10-30 |
| CVE-2026-119599 | medium | 4.3 | No | AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign system-level scopes by creati... | 2026-10-30 |
| CVE-2026-119598 | medium | 4.3 | No | Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs that allows authentic... | 2026-10-30 |
| CVE-2026-112347 | high | 7.6 | No | Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-... | 2026-10-30 |
| CVE-2026-119565 | medium | 4.3 | No | Plausible Analytics through 3.2.1 contains a mass assignment vulnerability in update_traffic_change_notification that allows authenticated s... | 2026-10-30 |
| CVE-2026-119564 | medium | 5.3 | No | Plausible Analytics Community Edition through 3.2.1 contains an information exposure vulnerability that allows site editors to obtain pendin... | 2026-10-30 |
| CVE-2026-119560 | medium | 5.9 | No | OPNsense core through 26.7.8 contains a configuration injection vulnerability that allows authenticated users to append ntpd.conf directives... | 2026-10-30 |
| CVE-2026-119552 | medium | 4.8 | No | Uptime Kuma through 2.5.8 contains a race condition in the Socket.IO first-run setup handler that allows unauthenticated attackers to create... | 2026-10-30 |
| CVE-2026-119548 | low | 3.1 | No | Lago through 1.55.0 contains an authorization bypass vulnerability in Invoices::Payments::StripeService that allows users of one organizatio... | 2026-10-30 |
| CVE-2026-119425 | medium | 5.4 | No | OPNsense core 26.1.6 through 26.7.7 contains an authentication bypass vulnerability in the captive portal roaming feature that lets unauthen... | 2026-10-30 |
| CVE-2026-119422 | medium | 5.9 | No | Juspay Hyperswitch before 1.128.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge payment sta... | 2026-10-30 |
| CVE-2026-119421 | medium | 5.9 | No | Juspay Hyperswitch through 1.128.0 (and builds before 2026.10.19.0) contains a missing authorization vulnerability that allows unauthenticat... | 2026-10-30 |
| CVE-2026-119409 | high | 7.2 | No | OPNsense before 26.7.8 contains a command injection vulnerability that allows authenticated users with the System: Firmware privilege to exe... | 2026-10-30 |
| CVE-2026-119325 | high | 7.5 | No | Bricks Theme 2.4 and before for WordPress contains an unauthenticated broken access control vulnerability in the load_popup_content REST end... | 2026-10-30 |
| CVE-2026-94175 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | 2026-10-30 |
| CVE-2026-90888 | critical | 9.8 | No | Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions. | 2026-10-30 |
| CVE-2026-62122 | medium | 5.3 | No | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-30 |