Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106208 | medium | 6.1 | No | Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensiti... | 2026-10-11 |
| CVE-2026-102262 | high | 7.3 | No | Newell Brands DYMO ID 1.5.1.71 resolves its plugin Modules directory relative to the process working directory. An attacker could store a jo... | 2026-10-11 |
| CVE-2026-102671 | medium | 5.3 | No | The Joyland AI app accepts invalid SSL certificates in the invisible advertisement WebView by default. | 2026-10-11 |
| CVE-2026-102670 | medium | 4.3 | No | Joyland AI app explicitly permits cleartext HTTP traffic on Android 9+ where the default is to block it. | 2026-10-11 |
| CVE-2026-102669 | medium | 5.3 | No | Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages. | 2026-10-11 |
| CVE-2026-102628 | critical | 9.3 | No | The Cadmos LTI application hosted at cadmos.eummena.io had Laravel debug mode enabled (APP_DEBUG=true, APP_ENV=local) in a publicly accessib... | 2026-10-11 |
| CVE-2026-100730 | critical | 9.8 | No | A service console interface on openPDC and openHistorian deserializes a client-supplied data structure. On systems using Windows Authenticat... | 2026-10-11 |
| CVE-2026-101893 | medium | 4.4 | No | Newell Brands DYMO ID 1.5.1.71 parses job files using XmlDocument.Load() without disabling DTD processing. The PC Job Files view automatical... | 2026-10-11 |
| CVE-2026-100251 | medium | 6.5 | No | Wormhole.app as deployed before 2026-08-22 misconfigures the coturn TURN server and does not properly restrict TCP relay peers, allowing an... | 2026-10-11 |
| CVE-2026-80729 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: mm/huge_memory: initialise workingset state before folio split xas_try... | 2026-10-11 |
| CVE-2026-97076 | high | 7.5 | No | Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n... | 2026-10-11 |
| CVE-2026-96539 | medium | 5.6 | No | Incorrect Privilege Assignment vulnerability in Ultimate Member Ultimate Member ultimate-member allows Privilege Escalation.This issue affec... | 2026-10-11 |
| CVE-2026-96336 | high | 7.5 | No | Authentication Bypass by Spoofing vulnerability in WPMU DEV Forminator forminator allows Identity Spoofing.This issue affects Forminator: fr... | 2026-10-11 |
| CVE-2026-96334 | medium | 5.6 | No | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Contro... | 2026-10-11 |
| CVE-2026-95597 | medium | 6.5 | No | Missing Authorization vulnerability in codemstory 워드프레스 결제 심플페이 pgall-for-woocommerce allows Exploiting Incorrectly Configured Ac... | 2026-10-11 |
| CVE-2026-94666 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ZealousWeb Generate PDF using Contact Form 7... | 2026-10-11 |
| CVE-2026-94065 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in BuddhaThemes ColorFolio colorit allows Object Injection.This issue affects ColorFolio: fr... | 2026-10-11 |
| CVE-2026-94064 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in BuddhaThemes Neo | Barber Shop WordPress Theme neocut allows Object Injection.This issue... | 2026-10-11 |
| CVE-2026-62028 | medium | 5.4 | No | Missing Authorization vulnerability in bPlugins Before After Image Comparison – Image comparison for WP before-after-image-compare allows Ex... | 2026-10-11 |
| CVE-2026-106602 | medium | 4.8 | No | Authentication Bypass Using an Alternate Path or Channel vulnerability in Automattic Jetpack jetpack allows Password Recovery Exploitation.T... | 2026-10-11 |