Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-69403 | medium | 5.5 | No | Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | 2026-09-21 |
| CVE-2026-86089 | high | 7.1 | No | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list e... | 2026-09-21 |
| CVE-2026-82561 | medium | 6.5 | No | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow d... | 2026-09-21 |
| CVE-2026-87250 | high | 7.6 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-21 |
| CVE-2026-70469 | high | 7.5 | No | Apache NiFi 2.11.0 disabled support for gzip-encoded HTTP requests for the application REST API and rejected requests that included the stan... | 2026-09-21 |
| CVE-2026-87249 | high | 7.1 | No | Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is af... | 2026-09-21 |
| CVE-2026-81866 | medium | 4.3 | No | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization... | 2026-09-21 |
| CVE-2026-92541 | high | 7.2 | No | The Import and export users and customers WordPress plugin before 2.5.2 does not enforce the promote_users capability in its front-end impor... | 2026-09-21 |
| CVE-2026-92540 | high | 7.2 | No | The Import and export users and customers WordPress plugin before 2.5.2 does not correctly enforce the promote_users capability when assigni... | 2026-09-21 |
| CVE-2026-92423 | low | 2.7 | No | The Meow Gallery WordPress plugin before 5.5.5 does not perform a proper capability check or restrict results to the requesting user's own p... | 2026-09-21 |
| CVE-2026-92422 | medium | 6.5 | No | The Meow Gallery WordPress plugin before 5.5.5 does not properly sanitize a user-supplied value before concatenating it into a shortcode str... | 2026-09-21 |
| CVE-2026-92410 | medium | 4.3 | No | The Sign-up Sheets WordPress plugin before 2.4.0 does not properly validate the CSRF nonce that protects its sign-up deletion action, allowi... | 2026-09-21 |
| CVE-2026-87840 | medium | 5.3 | No | The Tripzzy WordPress plugin before 1.5.1 does not perform any capability or ownership checks on its administrative booking-management actio... | 2026-09-21 |
| CVE-2026-87839 | high | 7.5 | No | The Tripzzy WordPress plugin before 1.5.1 does not have authorisation checks, and does not validate the identifier of the object being remov... | 2026-09-21 |
| CVE-2026-87068 | medium | 6.6 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not apply the role validation it enforces elsewhere when a registration form is n... | 2026-09-21 |
| CVE-2026-87067 | high | 8.5 | No | The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which classes may be instantiated when it deserialises a value taken... | 2026-09-21 |
| CVE-2026-85017 | high | 7.5 | No | The Unlimited Elements For Elementor WordPress plugin before 2.0.20 does not perform a capability check on an AJAX action and deserializes a... | 2026-09-21 |
| CVE-2026-84223 | medium | 6.8 | No | The Kirki WordPress plugin before 6.3.1 does not sanitize uploaded SVG files while making them uploadable site-wide, allowing users with aut... | 2026-09-21 |
| CVE-2026-82842 | high | 8.1 | No | The SAML Single Sign On WordPress plugin before 6.0.0 does not honour the configured criterion for linking an incoming single sign-on identi... | 2026-09-21 |
| CVE-2026-81654 | low | 3.1 | No | The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not check that a user holds its options capability before saving... | 2026-09-21 |