Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-96772 | medium | 5.3 | No | A security flaw has been discovered in Intelliants Subrion CMS up to 4.2.1. This affects an unknown part of the file /actions.json?action=as... | 2026-09-24 |
| CVE-2026-96601 | high | 7.3 | No | A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin... | 2026-09-24 |
| CVE-2026-96552 | low | 3.1 | No | A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected element is the function M... | 2026-09-24 |
| CVE-2026-84716 | medium | 6.6 | No | A flaw was found in the automation-controller instance install-bundle endpoint. When a System Administrator downloads an execution/hop nod... | 2026-09-24 |
| CVE-2026-82409 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts pla... | 2026-09-24 |
| CVE-2026-82406 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the native marketplace function core/kapp/market/mark... | 2026-09-24 |
| CVE-2026-82405 | not reported | — | No | Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, the KleverUpdateAccountPermission built-in authorizes... | 2026-09-24 |
| CVE-2026-75884 | critical | 9.1 | No | A flaw was found in AWX. The container group pod_spec_override field uses an incomplete blocklist that only restricts automountServiceAccoun... | 2026-09-24 |
| CVE-2026-63203 | high | 7.6 | No | Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/co... | 2026-09-24 |
| CVE-2026-61570 | high | 7.5 | No | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. From 5.5.5 until 16.4.1, Merlin... | 2026-09-24 |
| CVE-2026-4806 | medium | 6.5 | No | The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capabi... | 2026-09-24 |
| CVE-2026-18335 | medium | 5.4 | No | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in a... | 2026-09-24 |
| CVE-2026-18467 | critical | 9.8 | No | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and includin... | 2026-09-24 |
| CVE-2026-12227 | critical | 9.8 | No | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0... | 2026-09-24 |
| CVE-2026-93760 | high | 8.2 | No | Mongoid does not restrict which query operators may come from caller-supplied filter data when an application hands that data to its query-b... | 2026-09-24 |
| CVE-2026-93761 | high | 7.5 | No | An inefficient regular expression complexity issue in the in-memory query evaluation component of the Mongoid library may allow an unauthent... | 2026-09-24 |
| CVE-2026-93762 | critical | 9.8 | No | Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally suppl... | 2026-09-24 |
| CVE-2026-93763 | medium | 6.5 | No | A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application decl... | 2026-09-24 |
| CVE-2026-93764 | medium | 6.5 | No | Mongoid may omit encryption rules for fields declared on embedded models when generating the client-side field-level encryption schema. Appl... | 2026-09-24 |
| CVE-2026-11538 | medium | 5.3 | No | IBM WebSphere Application Server 9.0 and 8.5 is affected by a log injection vulnerability through crafted LTPA token cookies. | 2026-09-24 |