Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107650 | medium | 6.4 | No | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Sc... | 2026-10-14 |
| CVE-2026-109523 | high | 7.3 | No | A vulnerability was found in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this... | 2026-10-14 |
| CVE-2026-109519 | high | 8.3 | No | A vulnerability was detected in YouTransfer up to 0.0.7/1.0.6/1.1.0. Affected is an unknown function of the file /settings/template of the c... | 2026-10-14 |
| CVE-2026-104761 | medium | 6.4 | No | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and incl... | 2026-10-14 |
| CVE-2026-103369 | medium | 6.4 | No | The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'respon... | 2026-10-14 |
| CVE-2026-103422 | high | 7.2 | No | The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including,... | 2026-10-14 |
| CVE-2026-103028 | medium | 4.3 | No | SFTPGo is an open source, event-driven file transfer solution. From 2.5.0 until 2.7.6, an authenticated user with copy permission can copy a... | 2026-10-14 |
| CVE-2026-100153 | high | 7.2 | No | The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all ver... | 2026-10-14 |
| CVE-2026-85429 | high | 7.5 | No | MOOS-IvP uFldNodeComms through 24.8.1 trusts the source node identity from the message body rather than validating it from the connection so... | 2026-10-14 |
| CVE-2026-85433 | critical | 9.8 | No | MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network rou... | 2026-10-14 |
| CVE-2026-85425 | critical | 9.8 | No | MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to... | 2026-10-14 |
| CVE-2026-85427 | critical | 9.8 | No | MOOS essential-moos pAntler through 10.0.1 contains a remote code execution vulnerability that allows unauthenticated attackers to execute a... | 2026-10-14 |
| CVE-2026-85428 | critical | 9.8 | No | MOOS core-moos through 10.4.0 contains an authentication bypass vulnerability in the optional MOOSDB HTTP server that allows unauthenticated... | 2026-10-14 |
| CVE-2026-85430 | critical | 9.1 | No | MOOS essential-moos through 10.0.1 contains an authentication bypass vulnerability in pShare that accepts UDP datagrams from any source and... | 2026-10-14 |
| CVE-2026-87676 | medium | 5.7 | No | A stack-based buffer overflow vulnerability exists in the security library component of Brocade Fabric OS versions before 10.0.1. When parsi... | 2026-10-14 |
| CVE-2026-87678 | medium | 5.2 | No | An input validation and output encoding vulnerability exists in the web management interface of Brocade Fabric OS versions before 10.0.1. Wh... | 2026-10-14 |
| CVE-2026-87684 | critical | 9.8 | No | A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1. When proces... | 2026-10-14 |
| CVE-2026-85432 | high | 8.2 | No | MOOS core-moos through 10.4.0 fails to validate client identity in MOOSDB message processing, allowing authenticated attackers to attribute... | 2026-10-14 |
| CVE-2026-87686 | medium | 4.3 | No | An authentication and access control bypass vulnerability exists in the web server management interface of Brocade Fabric OS versions before... | 2026-10-14 |
| CVE-2026-97278 | high | 7.2 | No | Deserialization of Untrusted Data vulnerability in WP SYNTEX Polylang polylang allows Object Injection.This issue affects Polylang: from n/a... | 2026-10-14 |