Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116853 | medium | 6.5 | No | Unauthenticated Broken Access Control in GiveWP <= 4.19.0.1 versions. | 2026-10-30 |
| CVE-2026-116851 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | 2026-10-30 |
| CVE-2026-116847 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | 2026-10-30 |
| CVE-2026-116410 | medium | 6.5 | No | Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions. | 2026-10-30 |
| CVE-2026-116405 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | 2026-10-30 |
| CVE-2026-116386 | critical | 9.8 | No | Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions. | 2026-10-30 |
| CVE-2026-115947 | medium | 6.5 | No | Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions. | 2026-10-30 |
| CVE-2026-115604 | medium | 5.0 | No | Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions. | 2026-10-30 |
| CVE-2026-105077 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | 2026-10-30 |
| CVE-2026-104674 | medium | 4.3 | No | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.T... | 2026-10-30 |
| CVE-2026-119620 | high | 7.3 | No | A vulnerability was determined in 37954679 cak-filemanagement-system up to 5e6433246475e66462e1fea980688de96a049297. This vulnerability affe... | 2026-10-30 |
| CVE-2026-14467 | not reported | — | No | An information disclosure vulnerability in the Forocoches comments editor that allows an attacker to obtain unauthorised user information by... | 2026-10-30 |
| CVE-2026-115642 | high | 8.3 | No | In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in possession of an access-... | 2026-10-30 |
| CVE-2026-119568 | high | 7.4 | No | vsftpd through 3.0.5 contains an authentication bypass vulnerability in ssl_data_accept() that allows unauthenticated attackers to hijack FT... | 2026-10-30 |
| CVE-2026-119556 | medium | 4.3 | No | Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in... | 2026-10-30 |
| CVE-2026-119553 | medium | 6.5 | No | Moodle 5.3.0, 5.2.0 through 5.2.4, 5.1.0 through 5.1.8, 5.0.0 through 5.0.11, and through 4.5.15 contains a path traversal vulnerability in... | 2026-10-30 |
| CVE-2026-9239 | medium | 6.4 | No | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all ver... | 2026-10-30 |
| CVE-2026-97782 | medium | 6.8 | No | Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network. | 2026-10-30 |
| CVE-2026-97638 | high | 7.5 | No | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Referen... | 2026-10-30 |
| CVE-2026-96894 | high | 7.2 | No | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inb... | 2026-10-30 |