Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-10808 | critical | 9.8 | No | A weakness has been identified in Campcodes Farm Management System 1.0. Impacted is an unknown function of the file /uploadProduct.php. This... | 2026-10-01 |
| CVE-2025-10079 | critical | 9.8 | No | A flaw has been found in PHPGurukul Small CRM 4.0. Affected by this vulnerability is an unknown functionality of the file /get-quote.php. Ex... | 2026-10-01 |
| CVE-2025-9925 | critical | 9.8 | No | A vulnerability was found in projectworlds Travel Management System 1.0. This issue affects some unknown processing of the file /detail.php.... | 2026-10-01 |
| CVE-2026-101111 | medium | 6.1 | No | Joomla Extension - ordasoft.com - Reflected Cross-Site Scripting in Book Library (Free) < 6.4.6 - The public book-detail page template, site... | 2026-10-01 |
| CVE-2026-100269 | medium | 4.3 | No | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed | 2026-10-01 |
| CVE-2026-100268 | low | 2.7 | No | In JetBrains YouTrack before 2026.2.19197 project administrators could read comments from other projects via notification templates | 2026-10-01 |
| CVE-2026-102588 | medium | 6.5 | No | A flaw was found in Moodle. The XML grade import feature lacks proper Cross-Site Request Forgery (CSRF) token validation. By tricking an aut... | 2026-10-01 |
| CVE-2026-102586 | medium | 6.1 | No | A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cro... | 2026-10-01 |
| CVE-2026-84842 | high | 8.1 | No | IBM Guardium Data Protection 12.2 is vulnerable to path traversal and arbitrary file deletion in the Datasource REST component. An authentic... | 2026-10-01 |
| CVE-2026-84440 | high | 8.8 | No | IBM Guardium Data Protection 12.2 is vulnerable to command injection in the SNMP alert notification functionality. An authenticated attacker... | 2026-10-01 |
| CVE-2026-100267 | medium | 5.9 | No | In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters | 2026-10-01 |
| CVE-2026-102581 | medium | 5.4 | No | A flaw was found in Moodle. Insufficient output escaping in templates used to display forum posts enables a stored cross-site scripting (XSS... | 2026-10-01 |
| CVE-2026-102582 | medium | 4.3 | No | A flaw was found in Moodle. The manual enrolment management page did not properly check whether the manual enrolment plugin was disabled, al... | 2026-10-01 |
| CVE-2026-96573 | high | 7.2 | No | The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form... | 2026-10-01 |
| CVE-2026-96561 | high | 7.2 | No | The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions... | 2026-10-01 |
| CVE-2026-95137 | not reported | — | No | Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation... | 2026-10-01 |
| CVE-2026-94276 | not reported | — | No | Improper Authentication vulnerability in Apache APISIX. On a route using openid-connect plugin with remote introspection against an authori... | 2026-10-01 |
| CVE-2026-94269 | not reported | — | No | Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route... | 2026-10-01 |
| CVE-2026-94250 | not reported | — | No | Allocation of resources without limits or throttling vulnerability in batch-requests plugin in Apache APISIX. An unauthenticated caller can... | 2026-10-01 |
| CVE-2026-94220 | not reported | — | No | Cross-Site request forgery (CSRF) vulnerability in feishu-auth and dingtalk-auth plugins in Apache APISIX. An attacker who can get a user t... | 2026-10-01 |