Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-93293 | medium | 6.4 | No | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's purchase-completion... | 2026-10-29 |
| CVE-2026-89216 | not reported | — | No | The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, which allows u... | 2026-10-29 |
| CVE-2026-88928 | not reported | — | No | The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment notification endpoint w... | 2026-10-29 |
| CVE-2026-86794 | not reported | — | No | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public event submissions, and... | 2026-10-29 |
| CVE-2026-85007 | not reported | — | No | The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset AJAX handler, allowing u... | 2026-10-29 |
| CVE-2026-78396 | not reported | — | No | The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose display template is... | 2026-10-29 |
| CVE-2026-78395 | not reported | — | No | The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when processing its front-end... | 2026-10-29 |
| CVE-2026-87853 | high | 7.5 | No | A flaw was found in SSSD's IdP authentication provider. The eval_access_token_buf() function compares the OIDC subject identifier using strn... | 2026-10-29 |
| CVE-2026-5260 | high | 8.2 | No | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server usin... | 2026-10-29 |
| CVE-2026-58014 | high | 8.6 | No | A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loadin... | 2026-10-29 |
| CVE-2026-42013 | high | 8.2 | No | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to... | 2026-10-29 |
| CVE-2026-42012 | high | 7.1 | No | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains U... | 2026-10-29 |
| CVE-2026-42011 | high | 7.4 | No | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate... | 2026-10-29 |
| CVE-2026-19610 | medium | 6.5 | No | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The... | 2026-10-29 |
| CVE-2026-15564 | high | 7.4 | No | Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed. An attacker who can gain access to t... | 2026-10-29 |
| CVE-2026-118905 | high | 7.0 | No | Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions. In versions 0.31.2 through 0.40.5, `n... | 2026-10-29 |
| CVE-2026-115302 | not reported | — | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes stored form statistics... | 2026-10-29 |
| CVE-2026-115301 | not reported | — | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its forms and allows stored... | 2026-10-29 |
| CVE-2026-115300 | not reported | — | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two administrator-only acti... | 2026-10-29 |
| CVE-2026-115299 | not reported | — | No | The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail settings, allowing an attac... | 2026-10-29 |