Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109284 | medium | 4.3 | No | Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in... | 2026-10-13 |
| CVE-2026-109283 | medium | 5.4 | No | Open WebUI from 0.11.1 before 0.11.4 contains an authorization bypass in the OAuth token exchange endpoint, which reads role claims only fro... | 2026-10-13 |
| CVE-2026-88905 | high | 8.8 | No | The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not esc... | 2026-10-13 |
| CVE-2026-88903 | high | 8.8 | No | The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before... | 2026-10-13 |
| CVE-2026-88827 | high | 8.8 | No | The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the ho... | 2026-10-13 |
| CVE-2026-88826 | high | 8.8 | No | The SmugMug Embed WordPress plugin through 3.13 does not have authorisation or CSRF checks on an AJAX action that stores gallery data, and d... | 2026-10-13 |
| CVE-2026-88785 | medium | 4.7 | No | The Simple Membership WordPress plugin before 4.8.3 does not avoid transmitting a newly registered member's plaintext password in a URL quer... | 2026-10-13 |
| CVE-2026-87764 | high | 8.8 | No | The BuddyPress Instant Chat WordPress plugin through 1.6 does not check that the sender of a chat message belongs to the conversation it is... | 2026-10-13 |
| CVE-2026-87762 | high | 8.8 | No | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not have authorisation checks on several state-changing operations, an... | 2026-10-13 |
| CVE-2026-87761 | high | 8.0 | No | The Adwised Web Push Notification WordPress plugin through 2.5.7 does not perform any capability or nonce check before allowing an authentic... | 2026-10-13 |
| CVE-2026-87760 | high | 8.8 | No | The Web Vitals Tracking WordPress plugin through 5.4.2 does not validate or escape performance measurements submitted by unauthenticated vis... | 2026-10-13 |
| CVE-2026-86798 | high | 8.8 | No | The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the... | 2026-10-13 |
| CVE-2026-86717 | critical | 9.1 | No | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated... | 2026-10-13 |
| CVE-2026-86706 | critical | 9.1 | No | The Quick quotes WordPress plugin through 1.0.0 does not perform any capability or nonce check on one of its AJAX actions and lets the calle... | 2026-10-13 |
| CVE-2026-85126 | high | 7.2 | No | The Crowdfundly WordPress plugin through 2.2.2 does not have capability checks on some of its AJAX actions, allowing users holding one of it... | 2026-10-13 |
| CVE-2026-85121 | critical | 9.1 | No | The Insurify WordPress plugin through 1.0 does not have authorisation and nonce checks on one of its AJAX actions, allowing unauthenticated... | 2026-10-13 |
| CVE-2026-85118 | critical | 9.8 | No | The AI Content Generator Marketing WordPress plugin through 1.0.0 does not enforce a nonce or capability check on some of its AJAX actions,... | 2026-10-13 |
| CVE-2026-84737 | critical | 9.8 | No | The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthent... | 2026-10-13 |
| CVE-2026-84734 | critical | 9.8 | No | The Mindstien Quick Login WordPress plugin through 1.0 does not correctly validate a value supplied in the request against the visitor's own... | 2026-10-13 |
| CVE-2026-84261 | high | 8.8 | No | The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthentic... | 2026-10-13 |