Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62075 | high | 8.1 | No | Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions. | 2026-10-13 |
| CVE-2026-62074 | high | 8.1 | No | Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions. | 2026-10-13 |
| CVE-2026-62070 | high | 8.1 | No | Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions. | 2026-10-13 |
| CVE-2026-62069 | high | 8.1 | No | Unauthenticated Local File Inclusion in Fabius <= 1.0 versions. | 2026-10-13 |
| CVE-2026-62068 | high | 8.1 | No | Unauthenticated Local File Inclusion in Teoro <= 1.1 versions. | 2026-10-13 |
| CVE-2026-62067 | high | 8.1 | No | Unauthenticated Local File Inclusion in Kaven <= 1.2 versions. | 2026-10-13 |
| CVE-2026-62066 | high | 8.1 | No | Unauthenticated Local File Inclusion in Volos <= 1.2 versions. | 2026-10-13 |
| CVE-2026-62065 | high | 8.1 | No | Unauthenticated Local File Inclusion in Cardea <= 2.3 versions. | 2026-10-13 |
| CVE-2026-62064 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions. | 2026-10-13 |
| CVE-2026-62054 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Yacht Rental <= 2.6 versions. | 2026-10-13 |
| CVE-2026-62053 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Wine House <= 3.20 versions. | 2026-10-13 |
| CVE-2026-62052 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Tipsy <= 1.6 versions. | 2026-10-13 |
| CVE-2026-62051 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Stargaze <= 1.10 versions. | 2026-10-13 |
| CVE-2026-62050 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Splendour <= 1.23 versions. | 2026-10-13 |
| CVE-2026-62043 | high | 7.5 | No | Unauthenticated Sensitive Data Exposure in Contact Form 7 – Dynamic Text Extension <= 5.0.7 versions. | 2026-10-13 |
| CVE-2026-62038 | high | 7.3 | No | Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions. | 2026-10-13 |
| CVE-2026-62037 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions. | 2026-10-13 |
| CVE-2026-62035 | medium | 6.3 | No | Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions. | 2026-10-13 |
| CVE-2026-62034 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions. | 2026-10-13 |
| CVE-2026-62033 | high | 7.6 | No | Subscriber Settings Change in uListing <= 2.2.0 versions. | 2026-10-13 |