Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-95598 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-p... | 2026-10-09 |
| CVE-2026-97075 | medium | 6.5 | No | Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.... | 2026-10-09 |
| CVE-2026-97289 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master qui... | 2026-10-09 |
| CVE-2026-90983 | high | 8.2 | No | Use of Client-Side authentication vulnerability in Hayat Health Facilities Inc. (Hayat Hospital) Hayat Mobile allows Authentication Bypass.... | 2026-10-09 |
| CVE-2026-94066 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XS... | 2026-10-09 |
| CVE-2026-94062 | high | 8.1 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstat... | 2026-10-09 |
| CVE-2026-94668 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system sa... | 2026-10-09 |
| CVE-2026-94663 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid profilegrid-user... | 2026-10-09 |
| CVE-2026-94503 | critical | 10.0 | No | Unrestricted Upload of File with Dangerous Type vulnerability in PX-lab Zombify zombify allows Upload a Web Shell to a Web Server.This issue... | 2026-10-09 |
| CVE-2026-94161 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandresta... | 2026-10-09 |
| CVE-2026-75597 | medium | 5.3 | No | pyLoad is a free and open-source download manager written in Python. Prior to 0.5.0b3.dev101, the `/web/` route in `src/pyload/webui/app/blu... | 2026-10-09 |
| CVE-2026-78795 | high | 7.5 | No | An issue in Netcore B11 Enterprise-level full Gigabit 9-port shop wireless router v1.3.241114.024540 and before allows a remote attacker to... | 2026-10-09 |
| CVE-2026-78407 | medium | 5.4 | No | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting.... | 2026-10-09 |
| CVE-2026-75348 | high | 7.5 | No | An out-of-bounds read vulnerability exists in EIPStackGroup OpENer v2.3 and master up to commit 76b95cf in the EtherNet/IP TCP SendRRData Co... | 2026-10-09 |
| CVE-2026-62029 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels all... | 2026-10-09 |
| CVE-2026-62041 | medium | 5.4 | No | Missing Authorization vulnerability in Ashok Dudhat WP Event Manager wp-event-manager allows Exploiting Incorrectly Configured Access Contro... | 2026-10-09 |
| CVE-2026-55797 | high | 8.8 | No | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 2.11.0 until 3.3.15, 3.4.10, 3.5.4, and 3.6.0-rc2, the Argo C... | 2026-10-09 |
| CVE-2026-4264 | not reported | — | No | Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due... | 2026-10-09 |
| CVE-2026-108157 | high | 8.1 | No | Pingvin Share X from 0.19.0 before 1.22.0 contains an improper authentication vulnerability that allows remote unauthenticated attackers to... | 2026-10-09 |
| CVE-2026-108125 | not reported | — | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in wp-post-author. This issue affects wp... | 2026-10-09 |