Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-39787 | medium | 6.5 | No | Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions. | 2026-10-06 |
| CVE-2026-39784 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions. | 2026-10-06 |
| CVE-2026-39780 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions. | 2026-10-06 |
| CVE-2026-39778 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions. | 2026-10-06 |
| CVE-2026-39776 | high | 8.0 | No | Editor Remote Code Execution (RCE) in Tabs <= 2.5 versions. | 2026-10-06 |
| CVE-2026-39775 | high | 8.8 | No | Subscriber Privilege Escalation in JobZilla - Job Board WordPress Theme <= 2.2 versions. | 2026-10-06 |
| CVE-2026-39774 | high | 8.8 | No | Unauthenticated Privilege Escalation in Tourfic Pro <= 1.17.3 versions. | 2026-10-06 |
| CVE-2026-39773 | critical | 10.0 | No | Unauthenticated Privilege Escalation in Doctreat Core <= 1.7.0 versions. | 2026-10-06 |
| CVE-2026-39772 | medium | 5.3 | No | Unauthenticated Bypass Vulnerability in Captcha by BestWebSoft <= 5.2.8 versions. | 2026-10-06 |
| CVE-2026-39771 | high | 8.5 | No | Subscriber SQL Injection in Buddyboss Platform <= 3.1.0 versions. | 2026-10-06 |
| CVE-2026-39770 | critical | 10.0 | No | Unauthenticated Arbitrary File Upload in Doctreat <= 1.7.0 versions. | 2026-10-06 |
| CVE-2026-39767 | medium | 6.5 | No | Subscriber Denial of Service Attack in WPBase Cache <= 5.5.6 versions. | 2026-10-06 |
| CVE-2026-39766 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions. | 2026-10-06 |
| CVE-2026-39765 | high | 7.2 | No | Shop Manager Privilege Escalation in Challan <= 3.7.88 versions. | 2026-10-06 |
| CVE-2026-39764 | critical | 9.3 | No | Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions. | 2026-10-06 |
| CVE-2026-39762 | medium | 6.5 | No | Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Expl... | 2026-10-06 |
| CVE-2026-39761 | critical | 9.8 | No | Unauthenticated Privilege Escalation in Meta Box AIO <= 3.7.1 versions. | 2026-10-06 |
| CVE-2026-39759 | critical | 9.9 | No | Employer / Sales Representative Arbitrary File Upload in Workreap Core <= 3.4.5 versions. | 2026-10-06 |
| CVE-2026-39758 | high | 7.1 | No | Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions. | 2026-10-06 |
| CVE-2026-39757 | critical | 9.9 | No | Subscriber Arbitrary File Upload in Taskbot <= 6.6 versions. | 2026-10-06 |