Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-66626 | high | 7.6 | No | Editor SQL Injection in SKT Addons for Elementor <= 4.0 versions. | 2026-09-19 |
| CVE-2026-66617 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in PublishPress Series <= 3.1.3 versions. | 2026-09-19 |
| CVE-2026-66577 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in JetSearch <= 3.6.3 versions. | 2026-09-19 |
| CVE-2026-66572 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions. | 2026-09-19 |
| CVE-2026-1031 | medium | 6.1 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T... | 2026-09-19 |
| CVE-2026-1030 | medium | 4.3 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 generates an error message that includes... | 2026-09-19 |
| CVE-2026-1025 | medium | 6.1 | No | IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T... | 2026-09-19 |
| CVE-2026-2585 | medium | 6.4 | No | The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all version... | 2026-09-19 |
| CVE-2026-56795 | high | 8.2 | No | Dell Server Update Utility, versions prior to 26.07.01, contains an Uncontrolled Search Path Element vulnerability. A low privileged attacke... | 2026-09-19 |
| CVE-2026-20072 | medium | 4.9 | No | A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to obtain sensitive informa... | 2026-09-19 |
| CVE-2026-61516 | critical | 9.8 | No | Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an information disclosure vulnerability that allows unauthenticated attackers to ret... | 2026-09-19 |
| CVE-2026-15797 | medium | 6.4 | No | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Sto... | 2026-09-19 |
| CVE-2026-18442 | high | 7.5 | No | The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_u... | 2026-09-19 |
| CVE-2026-15275 | high | 7.5 | No | The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter... | 2026-09-19 |
| CVE-2026-15004 | medium | 5.4 | No | The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image al... | 2026-09-19 |
| CVE-2026-12954 | high | 8.8 | No | The Mapster WP Maps plugin for WordPress is vulnerable to Arbitrary User Meta Write in all versions up to, and including, 1.23.0 via the `my... | 2026-09-19 |
| CVE-2026-18441 | medium | 4.3 | No | The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Objec... | 2026-09-19 |
| CVE-2026-12739 | medium | 4.3 | No | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up... | 2026-09-19 |
| CVE-2026-11537 | medium | 4.3 | No | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to obtain sensitive information about the file system through th... | 2026-09-19 |
| CVE-2026-84048 | not reported | — | No | Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endp... | 2026-09-19 |