Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-54507 | not reported | — | No | Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.5, the oEmbedProxy()... | 2026-09-18 |
| CVE-2026-54578 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, mport_verify_package() in libmport/verify.c could continue after MD5File() or SHA2... | 2026-09-18 |
| CVE-2026-54576 | not reported | — | No | mport is the MidnightBSD Package Manager. Prior to 2.7.8, do_actual_install() in libmport/bundle_read_install_pkg.c used path-based lstat(),... | 2026-09-18 |
| CVE-2026-20350 | medium | 4.7 | No | A vulnerability in the web-based management interface of Cisco ThousandEyes Virtual Appliance could allow an authenticated, remote attacker... | 2026-09-18 |
| CVE-2026-20343 | high | 7.5 | No | A vulnerability in a critical API for Cisco Secure FMC Software could allow an unauthenticated, remote attacker to download sensitive files... | 2026-09-18 |
| CVE-2026-20300 | high | 7.1 | No | A vulnerability in Cisco ISE could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected device. To exploi... | 2026-09-18 |
| CVE-2026-20285 | medium | 4.3 | No | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity Connector (ISE-... | 2026-09-18 |
| CVE-2026-20325 | critical | 9.9 | No | As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Nexus Dashboard engineering team has conducted a... | 2026-09-18 |
| CVE-2026-17586 | medium | 6.4 | No | The VK All in One Expansion Unit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta... | 2026-09-18 |
| CVE-2026-18317 | medium | 4.3 | No | The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass... | 2026-09-18 |
| CVE-2026-17576 | medium | 6.5 | No | The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13... | 2026-09-18 |
| CVE-2026-18912 | high | 7.7 | No | ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticate... | 2026-09-18 |
| CVE-2026-17086 | high | 8.8 | No | The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all vers... | 2026-09-18 |
| CVE-2026-16582 | medium | 5.3 | No | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all ver... | 2026-09-18 |
| CVE-2026-20249 | high | 8.6 | No | A vulnerability in the certification authentication feature of Internet Key Exchange version 2 (IKEv2) for Cisco Secure Firewall Adaptive Se... | 2026-09-18 |
| CVE-2026-20154 | high | 8.6 | No | A vulnerability in the system rate-limiting process for syslog message 419002 of Cisco Secure Firewall Adaptive Security Appliance (ASA) Sof... | 2026-09-18 |
| CVE-2026-14323 | high | 7.5 | No | The Printcart Web to Print Product Designer for WooCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to,... | 2026-09-18 |
| CVE-2026-15650 | medium | 6.4 | No | The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointe... | 2026-09-18 |
| CVE-2026-14311 | medium | 5.4 | No | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data... | 2026-09-18 |
| CVE-2026-12106 | medium | 6.4 | No | The Auto Upload Images plugin for WordPress is vulnerable to Limited Server-Side Request Forgery in all versions up to, and including, 3.3.2... | 2026-09-18 |