Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-81921 | medium | 5.4 | No | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new acce... | 2026-09-18 |
| CVE-2026-81922 | low | 2.7 | No | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dash... | 2026-09-18 |
| CVE-2026-81923 | low | 2.7 | No | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() a... | 2026-09-18 |
| CVE-2026-81920 | medium | 4.3 | No | Concrete CMS below 9.5.3 was vulnerable to Cross-Site Request Forgery in the dashboard SEO Excluded Words page. The reset() controller actio... | 2026-09-18 |
| CVE-2026-81919 | medium | 4.3 | No | Concrete CMS below 9.5.3 did not validate an anti-CSRF token on the block-arrangement backend endpoint (the arrange() action of Concrete\Con... | 2026-09-18 |
| CVE-2026-81916 | medium | 4.3 | No | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather tha... | 2026-09-18 |
| CVE-2026-81917 | medium | 5.4 | No | Concrete CMS below 9.5.3 does not apply HTML output escaping to the file description and tags fields when rendering the Document Library blo... | 2026-09-18 |
| CVE-2026-69574 | high | 7.0 | No | Use after free in Windows Device Association Service allows an authorized attacker to elevate privileges locally. | 2026-09-18 |
| CVE-2026-93594 | high | 8.1 | No | ArcadeDB (Maven artifact com.arcadedb:arcadedb-engine) through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBuc... | 2026-09-18 |
| CVE-2026-92561 | medium | 6.1 | No | The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to,... | 2026-09-18 |
| CVE-2026-91707 | medium | 5.3 | No | The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to... | 2026-09-18 |
| CVE-2026-87915 | high | 7.2 | No | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to Sto... | 2026-09-18 |
| CVE-2026-89413 | high | 8.1 | No | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to th... | 2026-09-18 |
| CVE-2026-89278 | medium | 5.3 | No | The GPTranslate – Multilingual AI Translation Agent for WordPress: Translate Your Site with AI plugin for WordPress is vulnerable to Sensiti... | 2026-09-18 |
| CVE-2026-89138 | medium | 4.3 | No | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to th... | 2026-09-18 |
| CVE-2026-89064 | medium | 5.3 | No | The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Insufficient Credential Protection in versions up to, and inclu... | 2026-09-18 |
| CVE-2026-85705 | high | 7.5 | No | The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all v... | 2026-09-18 |
| CVE-2026-84909 | medium | 6.4 | No | The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncol... | 2026-09-18 |
| CVE-2026-75017 | medium | 4.3 | No | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is... | 2026-09-18 |
| CVE-2026-75880 | medium | 6.5 | No | An authenticated client could attach a consumer with a selector containing crafted wildcard usage that results in excessive evaluation durin... | 2026-09-18 |