Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97296 | high | 8.1 | No | Deserialization of Untrusted Data vulnerability in Rocketgenius, Inc Gravity Forms gravityforms allows Object Injection.This issue affects G... | 2026-10-16 |
| CVE-2026-96339 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflect... | 2026-10-16 |
| CVE-2026-94388 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in halfdata Green Popups halfdata-green-p... | 2026-10-16 |
| CVE-2026-94169 | critical | 10.0 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Theme-one The Grid the-grid allows Command Injection.This issue a... | 2026-10-16 |
| CVE-2026-110366 | medium | 5.3 | No | Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Securit... | 2026-10-16 |
| CVE-2026-111449 | medium | 5.9 | No | Wheels 3.0.0 through 4.1.1 can disclose detailed exceptions when allowIPBasedDebugAccess=true (disabled by default). An allowed administrato... | 2026-10-16 |
| CVE-2026-111448 | low | 3.7 | No | Wheels 4.0.0 through 4.1.2 uses case-insensitive comparisons in path-containment checks on case-sensitive filesystems. Canonical-path checks... | 2026-10-16 |
| CVE-2026-111444 | critical | 9.8 | No | Wheels through 4.1.2 allows SQL injection on MySQL/MariaDB with backslash escaping enabled (NO_BACKSLASH_ESCAPES absent) when an application... | 2026-10-16 |
| CVE-2026-111443 | medium | 6.5 | No | Wheels 4.0.6 through 4.1.2 lets an unauthenticated client switch a request into a separate test application context, including in production... | 2026-10-16 |
| CVE-2026-110912 | not reported | — | No | In DragonFly BSD through 6.4.2 before 4bb22ff, the ARP input handlers arpintr() and in_arpinput() (sys/netinet/if_ether.c) do not validate t... | 2026-10-16 |
| CVE-2026-97470 | medium | 6.4 | No | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Co... | 2026-10-16 |
| CVE-2026-97640 | high | 7.2 | No | The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vu... | 2026-10-16 |
| CVE-2026-97781 | high | 8.8 | No | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attac... | 2026-10-16 |
| CVE-2026-96768 | high | 7.2 | No | The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up t... | 2026-10-16 |
| CVE-2026-96870 | medium | 6.4 | No | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name... | 2026-10-16 |
| CVE-2026-96570 | high | 7.2 | No | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' para... | 2026-10-16 |
| CVE-2026-95809 | high | 7.2 | No | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-95686 | high | 7.2 | No | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to St... | 2026-10-16 |
| CVE-2026-96562 | medium | 6.5 | No | The The Broken Link Checker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.14... | 2026-10-16 |
| CVE-2026-96449 | medium | 5.3 | No | Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Lev... | 2026-10-16 |