Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86778 | medium | 5.3 | No | Observable response discrepancy vulnerability in Maksisoft Technology, IT, and Software Industry and Trade Inc. Maksisoft Gym allows Account... | 2026-09-30 |
| CVE-2026-6806 | high | 7.5 | No | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'stm_l... | 2026-09-30 |
| CVE-2026-6173 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'background_image' parameter of the plugin's... | 2026-09-30 |
| CVE-2026-6172 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter of the plugin's bt_bb_im... | 2026-09-30 |
| CVE-2026-6171 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' parameter of the plugin's bt_bb_ico... | 2026-09-30 |
| CVE-2026-6170 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'images' parameter of the plugin's bt_bb_css... | 2026-09-30 |
| CVE-2026-65102 | high | 7.8 | No | NVIDIA DeepStream contains a vulnerability where an attacker could cause an integer overflow by supplying crafted tensor dimensions in a YAM... | 2026-09-30 |
| CVE-2026-62097 | high | 7.6 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPTasty Business Directory business-di... | 2026-09-30 |
| CVE-2026-62084 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows... | 2026-09-30 |
| CVE-2026-19743 | high | 7.8 | No | Improper path validation in the local IPC service of TeamViewer Full Client and Host on Windows, Linux, and macOS prior to version 15.82 all... | 2026-09-30 |
| CVE-2026-16596 | medium | 6.5 | No | The WP Directory Kit plugin for WordPress is vulnerable to generic SQL Injection via the 'data_fields_list' parameter in all versions up to,... | 2026-09-30 |
| CVE-2026-14876 | medium | 6.4 | No | The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data-href' parameter in all versions up to, an... | 2026-09-30 |
| CVE-2026-11895 | medium | 6.4 | No | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi... | 2026-09-30 |
| CVE-2026-103389 | not reported | — | No | MISP contains a stored cross-site scripting (XSS) vulnerability in the galaxy icon handling path. The icon field of a galaxy object was pers... | 2026-09-30 |
| CVE-2026-103388 | not reported | — | No | MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL valida... | 2026-09-30 |
| CVE-2026-103270 | high | 7.5 | No | LightLLM through 1.2.0 mounts reinforcement learning control routes on the public HTTP API without authentication checks. Unauthenticated at... | 2026-09-30 |
| CVE-2026-102252 | not reported | — | No | A path traversal vulnerability (CWE-22) in the embedded VMDK filesystem extractor in Google OSV-SCALIBR versions 0.3.6 through 0.5.0 allows... | 2026-09-30 |
| CVE-2026-102371 | not reported | — | No | In wsl-pro-service before 0.1.19ubuntu3, the service component which runs as root inside each WSL instance attaches the instance to Ubuntu P... | 2026-09-30 |
| CVE-2026-100871 | high | 8.8 | No | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall identification in JWT tokens issued by separate... | 2026-09-30 |
| CVE-2026-100870 | high | 8.8 | No | Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-reset links using the request Host header w... | 2026-09-30 |