Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-94212 | not reported | — | No | Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user on... | 2026-10-01 |
| CVE-2026-92144 | high | 7.2 | No | The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-10-01 |
| CVE-2026-92244 | high | 7.2 | No | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name /... | 2026-10-01 |
| CVE-2026-92966 | critical | 9.1 | No | The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortco... | 2026-10-01 |
| CVE-2026-92537 | medium | 5.3 | No | The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versio... | 2026-10-01 |
| CVE-2026-79901 | critical | 9.9 | No | In deployments using BoKS keytab management, affected versions of boks_keytabmd generate Active Directory service-account passwords from a p... | 2026-10-01 |
| CVE-2026-88789 | high | 8.6 | No | Improper Restriction of XML External Entity Reference in the XSLT support extension (camel-quarkus-support-xalan) in Apache Camel Quarkus fr... | 2026-10-01 |
| CVE-2026-82806 | not reported | — | No | Exposure of data element to wrong session vulnerability in Apache APISIX. This issue affects Apache APISIX: from 2.3.0 before 3.7.0. Under... | 2026-10-01 |
| CVE-2026-89424 | medium | 6.4 | No | The Duplicate Post plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'noti_token' parameter in all versions up to, a... | 2026-10-01 |
| CVE-2026-84895 | high | 7.3 | No | In proxygen from v2026.04.06.00 until v2026.09.28.00, QuicWtSession::closeSession accesses its member fields after calling the base QuicWtSe... | 2026-10-01 |
| CVE-2026-78242 | not reported | — | No | Insertion of sensitive information into log file vulnerability in Apache APISIX. This vulnerability can cause the unmasked header value to... | 2026-10-01 |
| CVE-2026-64946 | not reported | — | No | A chained CSRF and unrestricted SVG file upload vulnerability in the File Manager module allows stored Cross-Site Scripting, enabling sessio... | 2026-10-01 |
| CVE-2026-55157 | high | 8.4 | No | Token Optimizer MCP measures token savings per AI coding agent, optimizes context, and shares a live local knowledge graph across 16 CLI cli... | 2026-10-01 |
| CVE-2026-55096 | high | 7.1 | No | fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list o... | 2026-10-01 |
| CVE-2026-103858 | not reported | — | No | MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies t... | 2026-10-01 |
| CVE-2026-103758 | high | 8.1 | No | Obot 0.21.1 through 0.24.1 contains an authorization bypass vulnerability that allows authenticated users to reach MCP servers because the c... | 2026-10-01 |
| CVE-2026-14995 | high | 7.2 | No | The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including,... | 2026-10-01 |
| CVE-2026-47096 | medium | 6.1 | No | AJA HELO Plus firmware before 2.1.7 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers with network... | 2026-10-01 |
| CVE-2026-103544 | medium | 6.3 | No | A vulnerability was found in datadrivenconstruction OpenConstructionERP up to 14.8.1. The impacted element is an unknown function of the fil... | 2026-10-01 |
| CVE-2026-103541 | medium | 6.3 | No | A vulnerability was detected in formtools.org Form Tools up to 3.1.1. This issue affects the function Files::uploadFile of the file global/c... | 2026-10-01 |