Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111451 | high | 7.8 | No | Wheels CLI 4.0.0 through 4.1.1 insufficiently validates or escapes caller-supplied values and package contents. Deploy release/version/rollb... | 2026-10-16 |
| CVE-2026-110019 | medium | 4.3 | No | The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 Thi... | 2026-10-16 |
| CVE-2026-109400 | high | 7.5 | No | The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and i... | 2026-10-16 |
| CVE-2026-110467 | medium | 4.3 | No | Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specif... | 2026-10-16 |
| CVE-2026-110445 | high | 8.8 | No | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users int... | 2026-10-16 |
| CVE-2026-110444 | high | 8.8 | No | TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users int... | 2026-10-16 |
| CVE-2026-108925 | medium | 6.1 | No | Improper neutralization of Script-Related HTML tags in a web page (basic XSS) vulnerability in Cohesity NetBackup Administration Console web... | 2026-10-16 |
| CVE-2026-107746 | high | 7.5 | No | The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, an... | 2026-10-16 |
| CVE-2026-107605 | medium | 6.2 | No | SWIFI-SE2KIC firmware versions 2.0.22 and prior are vulnerable to a Missing Authentication for Critical Function vulnerability that could al... | 2026-10-16 |
| CVE-2026-106170 | medium | 4.9 | No | An Uncaught Exception vulnerability [CWE-248] vulnerability in Fortinet FortiSandbox 5.2.0 through 5.2.1, FortiSandbox 5.0.0 through 5.0.6,... | 2026-10-16 |
| CVE-2026-107437 | medium | 6.2 | No | GV-E-Map Server V18.2.0A contains a plaintext database password embedded within an application component. The credential can be recovered th... | 2026-10-16 |
| CVE-2026-107373 | critical | 9.1 | No | ExtUtils::Typemaps::STL::String versions before 1.06 for Perl T_STD_STRING typemap may read the SV length before stringifying the argument.... | 2026-10-16 |
| CVE-2026-104000 | high | 7.2 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all version... | 2026-10-16 |
| CVE-2026-103895 | high | 8.1 | No | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass in versions up to,... | 2026-10-16 |
| CVE-2026-103480 | medium | 6.4 | No | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th... | 2026-10-16 |
| CVE-2026-103636 | high | 7.5 | No | Out-of-bounds read in the VarOpt union deserialization of Apache DataSketches C++ (repo: datasketches-cpp). var_opt_union::deserialize() re... | 2026-10-16 |
| CVE-2026-103635 | critical | 9.1 | No | Out-of-bounds read in the compact Theta sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). compact_theta_sketch::d... | 2026-10-16 |
| CVE-2026-103513 | critical | 9.8 | No | Out-of-bounds read and write in the CPC sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). A crafted serialized CP... | 2026-10-16 |
| CVE-2026-103501 | critical | 9.8 | No | Heap buffer overflow in the HLL sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp). When deserializing a sketch in... | 2026-10-16 |
| CVE-2026-102233 | high | 7.8 | No | Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. | 2026-10-16 |