Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87786 | high | 8.8 | No | The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an in... | 2026-09-18 |
| CVE-2026-86824 | medium | 4.8 | No | The Newsletter WordPress plugin before 9.3.8 does not generate its email tracking signing key with sufficient entropy and signs its tracking... | 2026-09-18 |
| CVE-2026-86788 | medium | 6.8 | No | The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in se... | 2026-09-18 |
| CVE-2026-86710 | critical | 9.8 | No | The Login with QR WordPress plugin through 1.0.0 does not verify that the code used to log a user in is one it issued, matching any stored u... | 2026-09-18 |
| CVE-2026-86709 | critical | 9.8 | No | The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unau... | 2026-09-18 |
| CVE-2026-86707 | critical | 9.8 | No | The Private Feed Key WordPress plugin through 0.1 does not verify that the key used to authenticate a feed request is one it issued, matchin... | 2026-09-18 |
| CVE-2026-86446 | low | 3.7 | No | The LearnPress WordPress plugin before 4.4.7 does not restrict the correctness flags it returns when a quiz answer is checked, allowing unau... | 2026-09-18 |
| CVE-2026-85130 | high | 8.8 | No | The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context... | 2026-09-18 |
| CVE-2026-85128 | high | 7.5 | No | The Choose User Role at Registration WordPress plugin before 1.3.3 does not validate the role requested at registration against the roles an... | 2026-09-18 |
| CVE-2026-25684 | medium | 4.4 | No | A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Contr... | 2026-09-18 |
| CVE-2026-59570 | high | 7.5 | No | On affected versions of Zscaler client connector, a pre-installed peer app can tear down the Zscaler tunnel, force user logout, and toggle p... | 2026-09-18 |
| CVE-2026-59569 | high | 8.1 | No | An improper input validation vulnerability in Zscaler Client Connector on Android and ChromeOS allows an attacker to potentially bypass Zsca... | 2026-09-18 |
| CVE-2026-25687 | high | 8.1 | No | A race condition in the ZPA tunnel handler of affected versions of Zscaler Client Connector (ZCC) allows a heap corruption, resulting in a d... | 2026-09-18 |
| CVE-2026-40539 | high | 7.1 | No | An improper certificate validation vulnerability in Email API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-72806-7 and... | 2026-09-18 |
| CVE-2026-40538 | low | 3.7 | No | An improper restriction of excessive authentication attempts vulnerability in Auto block in Synology DiskStation Manager (DSM) before 7.2.1-... | 2026-09-18 |
| CVE-2026-40537 | medium | 4.3 | No | A server-side request forgery (SSRF) vulnerability in PersonMail API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10, 7.2.2-7280... | 2026-09-18 |
| CVE-2026-40536 | medium | 4.3 | No | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Audio API in Synology DiskStation Manager... | 2026-09-18 |
| CVE-2026-40535 | medium | 6.5 | No | An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Desktop API in Synology DiskStation Manag... | 2026-09-18 |
| CVE-2026-40534 | medium | 5.4 | No | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Video API in Synology DiskStation M... | 2026-09-18 |
| CVE-2026-40533 | medium | 5.3 | No | An exposure of sensitive information through data queries vulnerability in Desktop API in Synology DiskStation Manager (DSM) before 7.2.1-69... | 2026-09-18 |