Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-107427 | medium | 6.5 | No | Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorr... | 2026-10-13 |
| CVE-2026-106605 | medium | 5.3 | No | Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce... | 2026-10-13 |
| CVE-2026-103356 | medium | 5.4 | No | Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Co... | 2026-10-13 |
| CVE-2026-78530 | high | 7.7 | No | Subscriber Arbitrary File Deletion in FoodBakery <= 4.6 versions. | 2026-10-13 |
| CVE-2026-66568 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Original <= 1.9.0 versions. | 2026-10-13 |
| CVE-2026-66567 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions. | 2026-10-13 |
| CVE-2026-66566 | high | 8.1 | No | Unauthenticated Local File Inclusion in Ambient <= 1.7 versions. | 2026-10-13 |
| CVE-2026-66565 | critical | 9.8 | No | Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions. | 2026-10-13 |
| CVE-2026-66564 | critical | 9.8 | No | Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions. | 2026-10-13 |
| CVE-2026-66563 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Windsor <= 2.10 versions. | 2026-10-13 |
| CVE-2026-66483 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions. | 2026-10-13 |
| CVE-2026-66482 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions. | 2026-10-13 |
| CVE-2026-66481 | medium | 6.8 | No | Author Arbitrary File Deletion in Presto Player Pro <= 3.0.1 versions. | 2026-10-13 |
| CVE-2026-66480 | medium | 5.3 | No | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in YITH YITH WooCommerce Product Add-Ons allows Ret... | 2026-10-13 |
| CVE-2026-65459 | high | 7.5 | No | Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions. | 2026-10-13 |
| CVE-2026-62130 | high | 7.2 | No | Shop manager PHP Object Injection in WooCommerce Multilingual & Multicurrency <= 5.5.8 versions. | 2026-10-13 |
| CVE-2026-62129 | critical | 9.9 | No | Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions. | 2026-10-13 |
| CVE-2026-62125 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions. | 2026-10-13 |
| CVE-2026-62124 | critical | 9.8 | No | Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions. | 2026-10-13 |
| CVE-2026-62123 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Invetex <= 2.18 versions. | 2026-10-13 |