Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104141 | not reported | — | No | DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names,... | 2026-10-15 |
| CVE-2026-104764 | high | 7.2 | No | The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 vi... | 2026-10-15 |
| CVE-2026-104748 | critical | 9.8 | No | The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications plugin for WordPress is vulnerable to Privilege Escala... | 2026-10-15 |
| CVE-2026-104800 | critical | 9.8 | No | The AGE-GATE plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0 via the 'width (and heigh... | 2026-10-15 |
| CVE-2026-104767 | high | 7.5 | No | The Membership & User Roles for WooCommerce (Automatic Role Changer) plugin for WordPress is vulnerable to Privilege Escalation in versions... | 2026-10-15 |
| CVE-2026-103529 | medium | 5.4 | No | Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxin... | 2026-10-15 |
| CVE-2026-103528 | medium | 5.4 | No | Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator... | 2026-10-15 |
| CVE-2026-102986 | high | 8.1 | No | Plane is an open-source project management tool. In 1.3.1 and earlier, EntityAssetEndpoint at the public project asset endpoint /api/public/... | 2026-10-15 |
| CVE-2026-103081 | high | 7.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Salevo woo-boost-sales allows Code Injection.This issu... | 2026-10-15 |
| CVE-2026-103358 | high | 7.5 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in VillaTheme Email Template Customizer for WooCommerce email-templa... | 2026-10-15 |
| CVE-2026-103380 | medium | 4.3 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information... | 2026-10-15 |
| CVE-2026-103366 | high | 7.5 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec... | 2026-10-15 |
| CVE-2026-102562 | high | 7.2 | No | The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::s... | 2026-10-15 |
| CVE-2026-103226 | medium | 6.3 | No | A vulnerability was identified in Artifex Ghostscript up to 10.07.0. Affected is the function type1_callsubr of the file devices/vector/gdev... | 2026-10-15 |
| CVE-2026-102354 | medium | 6.8 | No | BentoPDF is a privacy-focused PDF toolkit that runs in the browser. In versions through 2.8.6, cloudflare/cors-proxy-worker.js performs a DN... | 2026-10-15 |
| CVE-2026-101025 | medium | 5.3 | No | Description NGINX JavaScript (njs) has a vulnerability where the built-in njs engine leaks a libxml2 parser context when xml.parse() fails.... | 2026-10-15 |
| CVE-2026-101019 | medium | 6.5 | No | Description NGINX JavaScript (njs) has a vulnerability where the njs XML module exposes entity-backed XML attributes inconsistently with lib... | 2026-10-15 |
| CVE-2026-102251 | high | 7.5 | No | The Abandoned Cart Pro for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'validate' parameter in all versi... | 2026-10-15 |
| CVE-2026-100351 | high | 7.4 | No | kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation... | 2026-10-15 |
| CVE-2026-100347 | medium | 5.3 | No | kin-openapi is a Go project for handling OpenAPI files. Prior to 0.145.0, openapi3filter.ValidationHandler uses the routers/legacy router, w... | 2026-10-15 |