Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-97347 | high | 7.2 | No | The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to,... | 2026-09-30 |
| CVE-2026-96649 | high | 7.2 | No | The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-S... | 2026-09-30 |
| CVE-2026-96440 | not reported | — | No | Improper Limitation of a Pathname to a Restricted Directory（Path Traversal） in the /WebAgenda/download/uploadFile.jsp API endpoint of Flow... | 2026-09-30 |
| CVE-2026-97685 | not reported | — | No | An authenticated LimeSurvey Community Edition 7.3.0 user allowed to create surveys can use their own survey as an authorized context while s... | 2026-09-30 |
| CVE-2026-92712 | medium | 6.4 | No | The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parame... | 2026-09-30 |
| CVE-2026-92371 | high | 7.0 | No | TeamViewer Full Client and Host for Linux prior version 15.82 contains an improper path validation vulnerability in the Cloud Session Record... | 2026-09-30 |
| CVE-2026-92370 | high | 8.8 | No | An improper access control vulnerability in TeamViewer Full Client, Host, and related affected modules on Windows, Linux, and macOS allows a... | 2026-09-30 |
| CVE-2026-96326 | high | 7.2 | No | The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich... | 2026-09-30 |
| CVE-2026-92369 | high | 7.3 | No | TeamViewer Full Client and Host prior to version 15.82 on Windows contain a TOCTOU race condition in the installer rollback mechanism. A loc... | 2026-09-30 |
| CVE-2026-92368 | high | 7.8 | No | TeamViewer Full Client and Host for Linux and macOS prior version 15.82 contain a heap-based buffer overflow vulnerability in the processing... | 2026-09-30 |
| CVE-2026-92103 | not reported | — | No | Allocation of Resources Without Limits or Throttling vulnerability in elixir-mint mint allows a malicious HTTP/2 server to make the client h... | 2026-09-30 |
| CVE-2026-88037 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `title` attribute of the `bt_bb_service` sho... | 2026-09-30 |
| CVE-2026-89294 | high | 7.5 | No | The Simply Schedule Appointments plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.12.27... | 2026-09-30 |
| CVE-2026-86450 | high | 7.5 | No | Insertion of sensitive information into sent data vulnerability in Parla Auto Automotive Trading Limited Company DetaWix Mobile Web Portal a... | 2026-09-30 |
| CVE-2026-86158 | high | 7.7 | No | Missing authentication in the local .NET backend (Fiddler.WebUi) of Progress Software Fiddler Everywhere 8.0.2 allows a local unauthenticate... | 2026-09-30 |
| CVE-2026-86157 | medium | 5.6 | No | Exposure of privileged IPC functionality in Progress Telerik Fiddler Everywhere before version 8.2.0 allows a local, low-privileged attacker... | 2026-09-30 |
| CVE-2026-75098 | high | 7.5 | No | The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg'... | 2026-09-30 |
| CVE-2026-18783 | high | 8.8 | No | Missing authentication for critical function vulnerability in Trex Digital Smart Manufacturing Systems Inc. Trex MES allows Authentication B... | 2026-09-30 |
| CVE-2026-18782 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Trex Digital Smart Manufacturing Syste... | 2026-09-30 |
| CVE-2026-82307 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Dolusoft Software Technologies SOPLOG... | 2026-09-30 |