Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-66479 | high | 7.1 | No | Cross-Site Request Forgery (CSRF) vulnerability in Liquid Web / StellarWP WPComplete wpcomplete allows Stored XSS.This issue affects WPCompl... | 2026-10-08 |
| CVE-2026-62142 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in Melapress WP 2FA wp-2fa allows Cross Site Request Forgery.This issue affects WP 2FA: from... | 2026-10-08 |
| CVE-2026-62127 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-pl... | 2026-10-08 |
| CVE-2026-106600 | medium | 5.3 | No | Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security L... | 2026-10-08 |
| CVE-2026-106596 | medium | 5.3 | No | Missing Authorization vulnerability in Visual Composer Visual Composer Website Builder visualcomposer allows Exploiting Incorrectly Configur... | 2026-10-08 |
| CVE-2026-105893 | medium | 5.3 | No | Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating Use... | 2026-10-08 |
| CVE-2026-105890 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Block... | 2026-10-08 |
| CVE-2026-105887 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery all... | 2026-10-08 |
| CVE-2026-105886 | medium | 6.5 | No | Missing Authorization vulnerability in BdThemes Ultimate Post Kit ultimate-post-kit allows Exploiting Incorrectly Configured Access Control... | 2026-10-08 |
| CVE-2026-105878 | medium | 5.3 | No | Missing Authorization vulnerability in YITH YITH WooCommerce Product Bundles yith-woocommerce-product-bundles allows Exploiting Incorrectly... | 2026-10-08 |
| CVE-2026-105078 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-s... | 2026-10-08 |
| CVE-2026-105076 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Appsbd Vitepos vitepos-lite allows Bli... | 2026-10-08 |
| CVE-2026-103070 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer... | 2026-10-08 |
| CVE-2026-85097 | critical | 9.8 | No | The Bricksforge plugin for WordPress is vulnerable to unauthenticated arbitrary file upload in versions up to, and including, 3.1.8.9. This... | 2026-10-08 |
| CVE-2026-106290 | medium | 4.7 | No | Uninitialized resource in GPU in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the render... | 2026-10-08 |
| CVE-2026-106296 | medium | 5.4 | No | Improper privilege management in UI in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineerin... | 2026-10-08 |
| CVE-2026-39790 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows... | 2026-10-08 |
| CVE-2026-39723 | high | 7.5 | No | Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configure... | 2026-10-08 |
| CVE-2026-106196 | high | 7.6 | No | Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy... | 2026-10-08 |
| CVE-2024-8122 | medium | 5.9 | No | The WSO2 Identity Server fails to enforce a default expiry time for SMS One-Time Passwords (OTPs) used in multi-factor authentication (MFA).... | 2026-10-08 |