Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103305 | high | 8.8 | No | The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape so... | 2026-10-13 |
| CVE-2026-94257 | high | 8.1 | No | The SMS Alert WordPress plugin before 4.0.1 does not bind the account whose password is being changed to the phone number that was actually... | 2026-10-13 |
| CVE-2026-94256 | high | 8.1 | No | The SMS Alert WordPress plugin before 4.0.1 does not verify that the account being logged in is the one the verified one-time code belongs t... | 2026-10-13 |
| CVE-2026-87781 | high | 8.6 | No | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape a parameter before using it in a SQL statement, leading t... | 2026-10-13 |
| CVE-2026-87780 | high | 8.8 | No | The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint befo... | 2026-10-13 |
| CVE-2026-85571 | medium | 6.5 | No | The Tutor LMS WordPress plugin before 4.1.1 does not verify that the posts named in its course content ordering requests belong to a course... | 2026-10-13 |
| CVE-2026-107323 | medium | 6.8 | No | The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an... | 2026-10-13 |
| CVE-2026-107321 | medium | 5.4 | No | The W3 Total Cache WordPress plugin before 2.10.6 does not confine a media-import file copy to the document root, nor enforce an effective f... | 2026-10-13 |
| CVE-2026-107120 | medium | 5.3 | No | The Contest Gallery WordPress plugin before 33.0.1 does not limit the number of attempts against its front-end registration email-verificati... | 2026-10-13 |
| CVE-2026-105995 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.30 does not perform authorization checks before returning stored reservation data, allowing... | 2026-10-13 |
| CVE-2026-105990 | medium | 5.3 | No | The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization checks before exporting sto... | 2026-10-13 |
| CVE-2026-105989 | medium | 5.3 | No | The Accept PayPal Payments using Contact Form 7 WordPress plugin before 4.0.7 does not perform any authorization or request-validation check... | 2026-10-13 |
| CVE-2026-105977 | low | 2.2 | No | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform a per-object authorization check before deleting an attachment,... | 2026-10-13 |
| CVE-2026-105976 | medium | 4.7 | No | The Portfolio Filter Gallery WordPress plugin before 2.2.1 does not perform proper authorization checks in a set of AJAX actions, allowing u... | 2026-10-13 |
| CVE-2026-104754 | low | 3.5 | No | The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrativ... | 2026-10-13 |
| CVE-2026-104753 | medium | 4.1 | No | The Rank Math SEO WordPress plugin before 1.0.280 does not properly sanitise and escape a parameter before using it in a SQL query, allowing... | 2026-10-13 |
| CVE-2026-104752 | high | 7.2 | No | The Rank Math SEO WordPress plugin before 1.0.280 does not correctly validate the type of a file uploaded through its settings import featur... | 2026-10-13 |
| CVE-2026-100761 | high | 8.8 | No | Privilege escalation due to use-after-free in the Graphics: WebGPU component. This vulnerability was fixed in Thunderbird 157 and Firefox 15... | 2026-10-13 |
| CVE-2026-97687 | high | 8.1 | No | urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprin... | 2026-10-13 |
| CVE-2026-97688 | medium | 5.3 | No | urllib3 is an HTTP client library for Python. From 2.6.2 until 2.8.0, HTTPResponse.stream and HTTPResponse.read_chunked can enter an infinit... | 2026-10-13 |