Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-92249 | medium | 6.1 | No | The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to... | 2026-09-19 |
| CVE-2026-87935 | high | 8.1 | No | The Paid Downloads plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.15 via the admin_requ... | 2026-09-19 |
| CVE-2026-90541 | medium | 5.3 | No | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to require authentication in the plugin/TopMenu/menus.json.php end... | 2026-09-19 |
| CVE-2026-86749 | medium | 6.3 | No | Snipe-IT versions <= 8.6.3 (fixed in 8.7.0) do not check the return value of storage write operations in ImageUploadRequest::handleImages().... | 2026-09-19 |
| CVE-2026-86736 | medium | 4.3 | No | snipe-it before 8.7.0 contains an incorrect calculation vulnerability in checkout request handling that allows authenticated users to corrup... | 2026-09-19 |
| CVE-2026-85410 | high | 8.1 | No | The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for Wor... | 2026-09-19 |
| CVE-2026-86731 | medium | 6.5 | No | Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-us... | 2026-09-19 |
| CVE-2026-86726 | medium | 6.5 | No | AVideo through 29.0 contains an information disclosure vulnerability in restreamsActive.json.php that allows authenticated streamers to enum... | 2026-09-19 |
| CVE-2026-86721 | high | 7.5 | No | AVideo through commit c3edcc274c contains an authorization bypass vulnerability where a session cookie named 'key' with value 'value' overri... | 2026-09-19 |
| CVE-2026-84400 | low | 3.1 | No | CareCam CM2507 IP cameras contain an insufficiently protected network maintenance mechanism that can activate a remote debugging service. An... | 2026-09-19 |
| CVE-2026-84398 | high | 7.5 | No | CM2507 IP cameras accept an empty password for a privileged account exposed through its ONVIF management service. An attacker with network a... | 2026-09-19 |
| CVE-2026-82536 | high | 8.8 | No | Roo-Code through 3.54.0 contains an auto-approve bypass vulnerability in the shell command parsing logic that allows attackers to execute de... | 2026-09-19 |
| CVE-2026-81321 | critical | 9.8 | No | CM2507 IP cameras store configured wireless network credentials in cleartext within the device filesystem. An attacker who obtains filesyste... | 2026-09-19 |
| CVE-2026-81305 | medium | 6.8 | No | CM2507 IP cameras automatically execute a predetermined script from removable media without verifying its authenticity or integrity. An atta... | 2026-09-19 |
| CVE-2026-78294 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions. | 2026-09-19 |
| CVE-2026-78296 | medium | 5.3 | No | Insufficient Verification of Data Authenticity vulnerability in WP ManageNinja LLC FluentAuth allows Identity Spoofing. This issue affects... | 2026-09-19 |
| CVE-2026-76756 | medium | 5.9 | No | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. | 2026-09-19 |
| CVE-2026-76755 | medium | 5.9 | No | Vulnerability in Drupal Gammu SMS Daemon. This issue affects Gammu SMS Daemon versions: *.*. | 2026-09-19 |
| CVE-2026-75961 | medium | 4.9 | No | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params'... | 2026-09-19 |
| CVE-2026-73999 | medium | 5.4 | No | Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions. | 2026-09-19 |