Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-102673 | medium | 6.1 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.4, 42.5.2, and 43.0.0... | 2026-10-15 |
| CVE-2026-102674 | medium | 6.1 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, an... | 2026-10-15 |
| CVE-2026-94130 | critical | 9.8 | No | Joomla Extension - joomlaboat.com - Unauthenticated SQL injection in YouTube Gallery extension < 5.7.3 - An SQL injection vulnerability in v... | 2026-10-15 |
| CVE-2026-102676 | critical | 9.8 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 41.10.6, 42.9.2, 43.4.1, an... | 2026-10-15 |
| CVE-2026-0322 | high | 7.2 | Listed | A remote code execution (RCE) vulnerability in the management interface of Palo Alto Networks PAN-OS® software enables an authenticated atta... | 2026-10-15 |
| CVE-2026-76519 | critical | 9.8 | Listed | A vulnerability in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway could allow an unauthenticated, remote attack... | 2026-10-15 |
| CVE-2026-53362 | high | 7.8 | Listed | In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append... | 2026-10-15 |
| CVE-2025-46773 | high | 8.8 | No | An Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability [CWE-89] vulnerability in Fortinet For... | 2026-10-15 |
| CVE-2026-97205 | high | 8.1 | No | NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_core_module module. When asynchronous file I/O (AIO) is enabled in cer... | 2026-10-15 |
| CVE-2026-93479 | high | 8.1 | No | A vulnerability exists in NGINX Plus and NGINX Open Source when a map directive uses regex matching and the root directive or access log for... | 2026-10-15 |
| CVE-2026-94254 | medium | 5.3 | No | The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, al... | 2026-10-15 |
| CVE-2026-95631 | high | 8.7 | No | Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the... | 2026-10-15 |
| CVE-2026-92909 | critical | 9.8 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the c... | 2026-10-15 |
| CVE-2026-92464 | critical | 9.1 | No | Adobe Commerce is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the... | 2026-10-15 |
| CVE-2026-91184 | high | 8.8 | No | Description NGINX Gateway Fabric has a vulnerability when it renders the spec.basic.realm (and spec.jwt.realm) field of a namespaced Authen... | 2026-10-15 |
| CVE-2026-92426 | medium | 4.9 | No | The YITH WooCommerce Popup WordPress plugin before 1.60.0 does not check the capability of the requesting user before deleting post meta, al... | 2026-10-15 |
| CVE-2026-92409 | medium | 6.8 | No | The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an... | 2026-10-15 |
| CVE-2026-91076 | medium | 5.3 | No | The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notifica... | 2026-10-15 |
| CVE-2026-90989 | medium | 4.3 | No | The Tainacan WordPress plugin before 1.4.0 does not restrict its reports REST endpoints to users with a management capability, allowing any... | 2026-10-15 |
| CVE-2026-89288 | high | 8.6 | No | The Fast Courier WordPress plugin before 5.2.4 does not sanitize and escape a value before using it in a SQL query on an unauthenticated RES... | 2026-10-15 |