Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-62049 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet... | 2026-10-09 |
| CVE-2026-104392 | high | 8.8 | No | Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue af... | 2026-10-09 |
| CVE-2026-94067 | high | 8.1 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux... | 2026-10-09 |
| CVE-2026-94058 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflecte... | 2026-10-09 |
| CVE-2026-62042 | medium | 5.3 | No | Missing Authorization vulnerability in unFocus Projects Scripts n Styles scripts-n-styles allows Exploiting Incorrectly Configured Access Co... | 2026-10-09 |
| CVE-2026-108160 | high | 7.5 | No | AstronRPA through 1.1.6 contains a download of code without integrity check vulnerability that allows network attackers to deliver malicious... | 2026-10-09 |
| CVE-2026-62026 | high | 7.1 | No | Cross-Site Request Forgery (CSRF) vulnerability in MIGHTYminnow Dashboard Notes dashboard-notes allows Cross Site Request Forgery.This issue... | 2026-10-09 |
| CVE-2026-105883 | high | 7.1 | No | Missing Authorization vulnerability in ThemeHunk Th Shop Mania th-shop-mania allows Exploiting Incorrectly Configured Access Control Securit... | 2026-10-09 |
| CVE-2026-107802 | not reported | — | No | SumatraPDF is a multi-format reader for Windows. In 3.6.1 and earlier, src/SelectionTranslate.cpp embeds selected or pasted translation text... | 2026-10-09 |
| CVE-2026-105697 | critical | 9.9 | No | Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched what... | 2026-10-09 |
| CVE-2016-20098 | medium | 5.4 | No | Moderator Toolbox (reddit-moderator-toolbox) before 4.0.14 contains a stored cross-site scripting vulnerability in the removalreasons module... | 2026-10-09 |
| CVE-2026-73663 | critical | 9.8 | No | FreePBX is an open source IP PBX. From 16.0.0 until 16.0.11 and 17.0.4, the FreePBX missedcall module places the inbound Caller ID name from... | 2026-10-09 |
| CVE-2026-73665 | critical | 9.8 | No | FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js,... | 2026-10-09 |
| CVE-2026-107384 | high | 8.1 | No | MariaDB Connector/Node.js is used to connect applications developed on Node.js to MariaDB and MySQL databases. From 3.2.0 until 3.2.5, 3.3.4... | 2026-10-09 |
| CVE-2026-106121 | high | 7.5 | No | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com... | 2026-10-09 |
| CVE-2026-106122 | high | 7.5 | No | The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.36.0, Val... | 2026-10-09 |
| CVE-2026-96607 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-f... | 2026-10-09 |
| CVE-2026-96337 | medium | 6.5 | No | Missing Authorization vulnerability in properfraction ProfilePress wp-user-avatar allows Exploiting Incorrectly Configured Access Control Se... | 2026-10-09 |
| CVE-2026-96331 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-p... | 2026-10-09 |
| CVE-2026-95610 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in UpSolution UpSolution Core us-core all... | 2026-10-09 |