Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-104805 | not reported | — | No | DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured b... | 2026-10-06 |
| CVE-2026-104706 | not reported | — | No | DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://:... | 2026-10-06 |
| CVE-2026-84169 | medium | 5.3 | No | The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the o... | 2026-10-06 |
| CVE-2026-78371 | medium | 5.9 | No | The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is... | 2026-10-06 |
| CVE-2026-13607 | medium | 5.9 | No | The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads di... | 2026-10-06 |
| CVE-2026-93549 | high | 8.8 | No | The CoCart WordPress plugin before 4.9.7 does not scope its REST API authentication filter to its own endpoints, which disables WordPress co... | 2026-10-06 |
| CVE-2026-86817 | medium | 4.9 | No | The Five Star Business Profile and Schema WordPress plugin before 2.4.0 does not properly restrict the callbacks used to resolve schema fiel... | 2026-10-06 |
| CVE-2026-17005 | medium | 6.8 | No | The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before out... | 2026-10-06 |
| CVE-2026-104119 | low | 3.5 | No | The Simple Shopping Cart WordPress plugin before 5.2.6 does not escape some of its settings field values before outputting them on an admin... | 2026-10-06 |
| CVE-2026-104118 | medium | 5.3 | No | The Razorpay for WooCommerce WordPress plugin before 4.8.8 does not perform ownership or authorization checks on a REST API route used durin... | 2026-10-06 |
| CVE-2026-105122 | medium | 5.4 | No | OpenAM before 16.1.3 contains a server-side request forgery vulnerability that allows attackers able to register or modify OAuth 2.0 clients... | 2026-10-06 |
| CVE-2026-105121 | medium | 4.9 | No | OpenAM before 16.1.3 contains an improper authorization vulnerability that allows delegated administrators to destroy sessions outside their... | 2026-10-06 |
| CVE-2026-105120 | medium | 4.9 | No | OpenAM before 16.1.3 contains an authorization bypass vulnerability in the sessions REST endpoint query operation that allows realm administ... | 2026-10-06 |
| CVE-2026-105118 | medium | 4.7 | No | OpenAM before 16.1.3 contains an open redirect vulnerability that allows unauthenticated attackers to redirect users by supplying an unverif... | 2026-10-06 |
| CVE-2026-105117 | medium | 6.1 | No | OpenAM before 16.1.3 contains an email content injection vulnerability that allows unauthenticated attackers to control notification email w... | 2026-10-06 |
| CVE-2026-105116 | medium | 6.1 | No | OpenAM before 16.1.3 contains a latent cross-site scripting defect that places the SAML message, relay state and target URL unencoded into t... | 2026-10-06 |
| CVE-2026-105115 | high | 8.6 | No | OpenAM before 16.1.3 contains an unauthenticated arbitrary class instantiation vulnerability in the legacy JAX-RPC SOAP interface that allow... | 2026-10-06 |
| CVE-2026-96962 | low | 3.7 | No | The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors w... | 2026-10-06 |
| CVE-2026-94239 | medium | 6.8 | No | The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back i... | 2026-10-06 |
| CVE-2026-94238 | medium | 6.8 | No | The Loco Translate WordPress plugin before 2.8.9 does not restrict which file paths its translation file routes will read, allowing users gr... | 2026-10-06 |