Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-100668 | medium | 6.5 | No | Grav 2.0.0 through 2.0.24 contain a Twig content sandbox escape. The `array` filter (and its identical function form) is on the sandbox allo... | 2026-09-28 |
| CVE-2026-100664 | high | 7.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) versions 4.2.2.Final through 4.2.17.Final builds the HTTP/3 :authority pseudo-header from... | 2026-09-28 |
| CVE-2026-100660 | high | 7.5 | No | Netty's HTTP/3 codec (io.netty:netty-codec-http3) from 4.2.0.Final through 4.2.17.Final retains unbounded per-stream QPACK encoder state. Qp... | 2026-09-28 |
| CVE-2026-100636 | high | 7.6 | No | SiYuan versions before v3.8.4 contain a path traversal vulnerability in the exportBrowserHTML endpoint that allows authenticated administrat... | 2026-09-28 |
| CVE-2026-100314 | high | 7.3 | No | A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This i... | 2026-09-28 |
| CVE-2026-100311 | low | 3.5 | No | A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected eleme... | 2026-09-28 |
| CVE-2026-100599 | high | 8.8 | No | OpenClaw versions 2026.5.1 through 2026.7.0 fail to apply the configured exec approval path to Google Meet node commands. The googlemeet.chr... | 2026-09-28 |
| CVE-2026-93000 | medium | 6.8 | No | The SPS-Suite WordPress plugin through 1.4.0 does not sanitise the search query before using it in a SQL query when its static-page search f... | 2026-09-28 |
| CVE-2026-92996 | medium | 5.3 | No | The Verge3D WordPress plugin from 4.1.0 through 4.13.0 does not verify with the payment provider that a payment was actually made, and does... | 2026-09-28 |
| CVE-2026-89411 | medium | 5.3 | No | The Paymattic WordPress plugin from 4.6.20 before 4.6.26 does not verify that a confirmed Stripe payment belongs to the order it is applied... | 2026-09-28 |
| CVE-2026-89303 | medium | 6.4 | No | The Post Voting System WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL query, allowi... | 2026-09-28 |
| CVE-2026-89300 | medium | 5.3 | No | The WP Verify API WordPress plugin through 1.0.0 does not have any authorisation check in one of its REST routes, allowing unauthenticated u... | 2026-09-28 |
| CVE-2026-88828 | medium | 5.4 | No | The Blacklist Manager for WooCommerce WordPress plugin from 1.3.0 to 2.3.1 does not enforce its user blocking on every authentication path,... | 2026-09-28 |
| CVE-2026-86838 | medium | 5.3 | No | The Bookly WordPress plugin before 28.3 does not validate client-supplied booking quantity values on the server before computing the appoint... | 2026-09-28 |
| CVE-2026-84744 | medium | 6.5 | No | The WPForms Lite WordPress plugin from 1.5.0.1 to 2.0.2 does not remove shortcode delimiters from submitted field values before writing them... | 2026-09-28 |
| CVE-2026-92995 | medium | 5.3 | No | The Verge3D Publishing and E-Commerce WordPress plugin through 4.13.0 does not restrict access to a file-download handler, allowing unauthen... | 2026-09-28 |
| CVE-2026-92436 | medium | 5.3 | No | The Mailchimp for WooCommerce WordPress plugin before 6.3 does not require authentication or verify ownership before loading a saved cart fr... | 2026-09-28 |
| CVE-2026-89006 | medium | 6.8 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not sanitize imported feed content before storing it as post content, all... | 2026-09-28 |
| CVE-2026-89003 | medium | 4.1 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not perform a capability check before fetching a user-supplied URL and re... | 2026-09-28 |
| CVE-2026-89001 | medium | 4.9 | No | The WPeMatico RSS Feed Fetcher WordPress plugin before 2.8.27 does not verify that a user running a feed campaign is permitted to publish co... | 2026-09-28 |