Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109314 | high | 7.3 | No | Grav Login plugin 1.2.0 before 3.9.9 contains an information disclosure vulnerability that allows publishers to obtain password-reset tokens... | 2026-10-15 |
| CVE-2026-109313 | high | 8.1 | No | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass vulnerability that allows attackers with a valid password to skip two... | 2026-10-15 |
| CVE-2026-109312 | high | 8.1 | No | Grav Login plugin 2.7.0 before 3.9.9 contains an authentication bypass in processUserProfile(), which checks that the session user exists bu... | 2026-10-15 |
| CVE-2026-17620 | high | 7.5 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift 4.0.6.0 through 4.0.6.0.0.6.0 Refresh (Operator 4.4.6+20260807.081800)4.0.7.04.... | 2026-10-15 |
| CVE-2026-17618 | critical | 9.8 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive info... | 2026-10-15 |
| CVE-2026-91800 | high | 8.8 | No | A local privilege escalation vulnerability exists in the installer of Foxit PDF Editor for macOS due to insufficient validation of a user-mo... | 2026-10-15 |
| CVE-2026-91807 | medium | 6.1 | No | A heap-based out-of-bounds read vulnerability exists in Foxit PDF Editor/Reader’s handling of malformed image soft-mask data. Insufficient v... | 2026-10-15 |
| CVE-2026-96537 | high | 7.5 | No | The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing un... | 2026-10-15 |
| CVE-2026-92429 | medium | 5.3 | No | The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an... | 2026-10-15 |
| CVE-2026-92428 | medium | 5.3 | No | The Rede Itaú for WooCommerce WordPress plugin before 5.5.3 does not verify the authenticity of a payment gateway webhook before updating an... | 2026-10-15 |
| CVE-2026-74920 | high | 7.1 | No | The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML att... | 2026-10-15 |
| CVE-2026-109145 | critical | 9.8 | No | The User Rights Access Manager WordPress plugin through 1.1.3 does not restrict access to one of its AJAX account-registration handlers and... | 2026-10-15 |
| CVE-2026-106031 | medium | 6.5 | No | The Spin Wheel WordPress plugin before 2.2.1 does not verify that a visitor actually performed a legitimate spin before returning and consum... | 2026-10-15 |
| CVE-2026-104643 | medium | 4.2 | No | The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any... | 2026-10-15 |
| CVE-2026-103324 | medium | 5.3 | No | The Cardinity Payment Gateway for WooCommerce WordPress plugin before 3.4.2 does not properly verify the authenticity of the payment notific... | 2026-10-15 |
| CVE-2026-103304 | medium | 5.3 | No | The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX... | 2026-10-15 |
| CVE-2026-110772 | medium | 4.3 | No | Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows fa... | 2026-10-15 |
| CVE-2026-110771 | medium | 4.3 | No | Shopizer through 3.2.5 contains an authorization bypass vulnerability that allows authenticated customers to post reviews as other customers... | 2026-10-15 |
| CVE-2026-110770 | high | 8.1 | No | Databasus 3.7.0 through 3.61.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to brute-force password... | 2026-10-15 |
| CVE-2026-110766 | medium | 4.3 | No | Colanode server through 0.4.7 contains a path traversal vulnerability that allows authenticated users to read arbitrary .jpeg files by suppl... | 2026-10-15 |