Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-82524 | high | 7.2 | No | UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP fil... | 2026-10-06 |
| CVE-2026-66666 | not reported | — | No | Insertion of Sensitive Information Into Sent Data vulnerability in Automattic WordPress allows Retrieve Embedded Sensitive Data. This issue... | 2026-10-06 |
| CVE-2026-19856 | medium | 6.5 | No | The All in One SEO WordPress plugin before 5.0.2.1 does not correctly determine which shortcodes are present in content derived from user in... | 2026-10-06 |
| CVE-2026-18161 | medium | 4.3 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to falsify transaction audit logs d... | 2026-10-06 |
| CVE-2026-18162 | critical | 9.8 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper neutral... | 2026-10-06 |
| CVE-2026-18163 | critical | 9.8 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deseria... | 2026-10-06 |
| CVE-2026-18169 | critical | 9.9 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due... | 2026-10-06 |
| CVE-2026-18170 | medium | 6.5 | No | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of... | 2026-10-06 |
| CVE-2026-86104 | high | 7.5 | No | An uncontrolled resource consumption vulnerability in the Fireware OS login process (wgagent) allows a remote, unauthenticated attacker to c... | 2026-10-06 |
| CVE-2026-86105 | high | 7.1 | No | An improper authorization vulnerability in Fireware OS's Access Portal reverse proxy allows an authenticated, low-privileged Access Portal u... | 2026-10-06 |
| CVE-2026-86128 | high | 7.5 | No | A NULL pointer dereference vulnerability in Fireware OS's NetFlow packet-processing feature allows a remote, unauthenticated attacker to cau... | 2026-10-06 |
| CVE-2026-86131 | critical | 9.8 | No | A code injection vulnerability in WatchGuard Fireware OS's BOVPN Over TLS client configuration handling allows an attacker who controls the... | 2026-10-06 |
| CVE-2026-86132 | high | 7.5 | No | An integer underflow vulnerability in the WatchGuard Fireware OS IKEv2 daemon (iked) allows a remote, unauthenticated attacker to crash the... | 2026-10-06 |
| CVE-2026-86133 | high | 7.5 | No | An integer underflow vulnerability in the WatchGuard Fireware OS IKE daemon (iked) allows a remote attacker who has completed the initial IK... | 2026-10-06 |
| CVE-2026-86136 | high | 8.1 | No | A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privil... | 2026-10-06 |
| CVE-2026-95140 | high | 7.5 | No | kkFileView v5.0.0 through v5.0.2 contains a directory traversal vulnerability in FileController.java. The fileUpload, createFolder and exist... | 2026-10-06 |
| CVE-2026-85523 | high | 8.8 | No | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Felisify Information Technologie... | 2026-10-06 |
| CVE-2026-82924 | medium | 5.3 | No | Improper Control of Interaction Frequency vulnerability in Pusula Communication, IT, and Internet Industry and Trade Co. Ltd. Expert Mail al... | 2026-10-06 |
| CVE-2026-34498 | not reported | — | No | Improper input validation vulnerability in Johnson Controls Illustra Standard - L4L China on Windows allows OS Command Injection. This issu... | 2026-10-06 |
| CVE-2026-12380 | medium | 6.1 | No | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies L... | 2026-10-06 |