Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103907 | medium | 6.5 | No | The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both th... | 2026-10-14 |
| CVE-2026-104749 | high | 7.5 | No | The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Privilege... | 2026-10-14 |
| CVE-2026-100163 | high | 7.4 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass... | 2026-10-14 |
| CVE-2026-100193 | medium | 4.7 | No | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' para... | 2026-10-14 |
| CVE-2022-37454 | critical | 9.8 | No | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to... | 2026-10-14 |
| CVE-2022-37434 | critical | 9.8 | No | zlib through 1.2.12 has a heap-based buffer over-read or buffer overflow in inflate in inflate.c via a large gzip header extra field. NOTE:... | 2026-10-14 |
| CVE-2025-36178 | medium | 5.4 | No | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow an authenticated user to bypass input validation due to... | 2026-10-14 |
| CVE-2025-36147 | medium | 6.1 | No | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4.0 through 3.2.4.16 is vulnerable to cross-site scripting. This... | 2026-10-14 |
| CVE-2025-36076 | medium | 4.3 | No | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 stores sensitive information in source code could be used by a... | 2026-10-14 |
| CVE-2025-36045 | medium | 4.3 | No | IBM TS4300 1.1.0.1 through 1.7.1.1 could allow an authenticated user to cause a denial of service in the email service due to improper contr... | 2026-10-14 |
| CVE-2025-33147 | medium | 5.9 | No | IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 could allow an attacker on a shared network to obtain sensitiv... | 2026-10-14 |
| CVE-2025-33141 | medium | 6.5 | No | IBM QRadar 7.5.0 through 7.5.0 UP15 Interim Fix 006 could allow an authenticated user to obtain sensitive information from backup files due... | 2026-10-14 |
| CVE-2025-15399 | critical | 10.0 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site request forg... | 2026-10-14 |
| CVE-2025-14754 | high | 8.8 | No | IBM Cloud Pak for Data 5.1.2 could allow an authenticated user to execute arbitrary commands with elevated privileges on the system due to i... | 2026-10-14 |
| CVE-2025-14753 | high | 7.5 | No | IBM Cloud Pak for Data 5.1.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted... | 2026-10-14 |
| CVE-2025-1350 | medium | 5.3 | No | IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a... | 2026-10-14 |
| CVE-2025-13882 | medium | 5.3 | No | IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Eng... | 2026-10-14 |
| CVE-2026-90995 | medium | 5.5 | No | A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication... | 2026-10-14 |
| CVE-2026-88064 | high | 8.8 | No | Backstage is an open framework for building developer portals. Prior to 1.14.6 and from 1.15.0 until 1.15.4, the @backstage/plugin-techdocs-... | 2026-10-14 |
| CVE-2026-110146 | medium | 6.5 | No | Information leak in Passwords in Google Chrome prior to 155.0.8059.79 allowed a remote attacker leveraging social engineering to obtain sens... | 2026-10-14 |