Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100900 | medium | 5.5 | No | A vulnerability has been found in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/v2.0.0-beta1. Affected is the function updateJiraPr... | 2026-10-01 |
| CVE-2026-100179 | medium | 6.1 | No | The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Refl... | 2026-10-01 |
| CVE-2026-102583 | low | 2.7 | No | A flaw was found in Moodle. An incorrect capability check in the artificial intelligence (AI) editor placement's image generation web servic... | 2026-10-01 |
| CVE-2026-103244 | critical | 9.8 | No | ground-station versions before 0.8.0 contain an authentication bypass vulnerability in the setup.restore command that allows unauthenticated... | 2026-10-01 |
| CVE-2026-95290 | medium | 5.4 | No | Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to b... | 2026-10-01 |
| CVE-2026-66253 | low | 3.1 | No | iControl is affected by a Session Timeout vulnerability, which could allow an attacker to exploit an unattended or abandoned active session,... | 2026-10-01 |
| CVE-2026-66249 | low | 3.1 | No | iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencr... | 2026-10-01 |
| CVE-2026-66248 | low | 3.1 | No | iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database... | 2026-10-01 |
| CVE-2026-66247 | medium | 4.3 | No | iControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to exec... | 2026-10-01 |
| CVE-2026-66246 | high | 8.8 | No | iControl is affected by a Broken Access Control vulnerability, which could allow an attacker to exploit missing authentication checks or ins... | 2026-10-01 |
| CVE-2026-103547 | not reported | — | No | In ldapd in OpenBSD 7.8 before errata 057 and 7.9 before errata 021, delegated BSD authentication results are correlated only by the LDAP ch... | 2026-10-01 |
| CVE-2026-95297 | medium | 6.5 | No | Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via... | 2026-10-01 |
| CVE-2026-95300 | medium | 4.8 | No | Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass... | 2026-10-01 |
| CVE-2026-95301 | high | 8.1 | No | Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer proce... | 2026-10-01 |
| CVE-2026-103292 | high | 8.0 | No | Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the {{ghost_h... | 2026-10-01 |
| CVE-2026-103289 | medium | 6.5 | No | Ghost from 5.9.0 before 6.44.1 contains an input validation issue in the comments feature that allows authenticated members to access commen... | 2026-10-01 |
| CVE-2026-103288 | medium | 6.5 | No | Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.... | 2026-10-01 |
| CVE-2026-103285 | medium | 4.3 | No | Ghost versions from 5.19.0 before 6.57.1 contain a cross-site request forgery vulnerability in the post feedback functionality that allows a... | 2026-10-01 |
| CVE-2026-103284 | medium | 4.3 | No | Ghost versions from 5.125.1 before 6.57.1 contain an information disclosure vulnerability in the Admin Feedback endpoint that allows unautho... | 2026-10-01 |
| CVE-2026-103281 | medium | 5.4 | No | Ghost (npm package 'ghost') versions from 3.23.0 up to, but not including, 6.23.0 expose API keys to users with low-privilege staff accounts... | 2026-10-01 |