Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-89055 | critical | 9.1 | No | The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.120.... | 2026-09-25 |
| CVE-2026-84280 | high | 7.2 | No | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Paramete... | 2026-09-25 |
| CVE-2026-84279 | high | 7.2 | No | The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'output_format' parameter in all versio... | 2026-09-25 |
| CVE-2026-83591 | high | 7.2 | No | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Regex Tr... | 2026-09-25 |
| CVE-2026-19804 | high | 8.8 | No | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vu... | 2026-09-25 |
| CVE-2026-17602 | medium | 4.9 | No | The SSL Zen — SSL Certificate Installer & HTTPS Redirects plugin for WordPress is vulnerable to Directory Traversal in all versions up to, a... | 2026-09-25 |
| CVE-2026-13456 | high | 7.5 | No | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File In... | 2026-09-25 |
| CVE-2026-62062 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in Elementor Website Builder allows Cross Site Request Forgery. This issue affects Elemento... | 2026-09-25 |
| CVE-2026-19775 | medium | 4.3 | No | The OpenStation — Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to authorization bypass in all ve... | 2026-09-25 |
| CVE-2026-13179 | medium | 6.4 | No | The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-... | 2026-09-25 |
| CVE-2026-12037 | medium | 5.5 | No | The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including... | 2026-09-25 |
| CVE-2026-93758 | high | 8.1 | No | An insecure direct object reference in the nested attributes handling of the Mongoid object-document mapper may allow a user with basic appl... | 2026-09-25 |
| CVE-2026-93765 | critical | 9.1 | No | Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are p... | 2026-09-25 |
| CVE-2026-82356 | high | 7.5 | No | Imprivata EAM <=26.2.6 lacks the ability to rotate its RSA key pair after deployment when generating an X.509 certificate. Using an RSA key... | 2026-09-25 |
| CVE-2026-91129 | medium | 5.4 | No | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP integration automati... | 2026-09-25 |
| CVE-2026-63349 | not reported | — | No | AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accept... | 2026-09-25 |
| CVE-2026-48785 | medium | 4.8 | No | Apptainer is an open source container platform. Prior to version 1.5.1, Image.AuthorizedPath applies plain string-prefix matching to the lim... | 2026-09-25 |
| CVE-2026-53718 | medium | 6.4 | No | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and... | 2026-09-25 |
| CVE-2026-53715 | medium | 5.3 | No | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and... | 2026-09-25 |
| CVE-2026-53495 | not reported | — | No | containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd on Linux with the CRI plugin enabled c... | 2026-09-25 |