Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-91829 | high | 7.1 | No | The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allo... | 2026-10-13 |
| CVE-2026-89305 | medium | 6.5 | No | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing any aut... | 2026-10-13 |
| CVE-2026-89304 | medium | 6.5 | No | The paymendo WordPress plugin through 1.1 does not properly sanitize and escape a parameter before using it in a SQL query, allowing unauthe... | 2026-10-13 |
| CVE-2026-89302 | high | 8.6 | No | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowi... | 2026-10-13 |
| CVE-2026-89299 | high | 8.6 | No | The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowing... | 2026-10-13 |
| CVE-2026-89297 | high | 8.6 | No | The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowin... | 2026-10-13 |
| CVE-2026-89287 | high | 8.6 | No | The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape a parameter before using it in SQL statements, allowi... | 2026-10-13 |
| CVE-2026-89285 | high | 8.6 | No | The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several request parameters before using them to build a SQL quer... | 2026-10-13 |
| CVE-2026-89283 | high | 8.6 | No | The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password acti... | 2026-10-13 |
| CVE-2026-89234 | high | 8.6 | No | The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthentica... | 2026-10-13 |
| CVE-2026-89232 | high | 8.6 | No | The Recordbrowser WordPress plugin through 1.1.7 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthent... | 2026-10-13 |
| CVE-2026-89214 | high | 8.6 | No | The WpCues Basic Quiz WordPress plugin through 1.6.5 does not properly sanitise and escape values before using them in a SQL statement, whic... | 2026-10-13 |
| CVE-2026-89213 | high | 8.6 | No | The Llavero.io WordPress plugin through 0.1.4 does not properly sanitise and escape a parameter before using it in a SQL statement, which al... | 2026-10-13 |
| CVE-2026-89195 | high | 8.6 | No | The Site Setup Wizard WordPress plugin through 1.5.8 does not properly sanitise and escape a parameter before using it in a SQL statement, w... | 2026-10-13 |
| CVE-2026-88930 | high | 8.6 | No | The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it... | 2026-10-13 |
| CVE-2026-67456 | medium | 4.4 | No | NVIDIA Warp contains a vulnerability where an attacker could cause a heap-based buffer overflow. A successful exploit of this vulnerability... | 2026-10-13 |
| CVE-2026-65180 | high | 7.8 | No | NVIDIA Megatron-LM contains a vulnerability in checkpoint loading where an Attacker may cause an RCE by convincing a user to load a maliciou... | 2026-10-13 |
| CVE-2026-95106 | critical | 9.1 | No | Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views reso... | 2026-10-13 |
| CVE-2026-103417 | medium | 5.5 | No | Firefox for iOS could autofill saved credentials into a new page if cross-origin navigation occurred while the saved-login UI was open. Auto... | 2026-10-13 |
| CVE-2026-65173 | critical | 9.1 | No | NVIDIA AIStore for Linux contains a missing authentication vulnerability in the token-revocation endpoint where an unauthenticated remote at... | 2026-10-13 |