Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19857 | medium | 4.8 | No | The Formidable Forms WordPress plugin before 6.35 does not prevent a request-derived value from reaching the WordPress shortcode parser when... | 2026-09-16 |
| CVE-2026-13407 | medium | 5.4 | No | The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget b... | 2026-09-16 |
| CVE-2026-18232 | medium | 5.3 | No | The WP Directory Kit WordPress plugin through 1.5.7 does not check the status or ownership of a listing before returning its content through... | 2026-09-16 |
| CVE-2026-16593 | medium | 6.8 | No | The WP Directory Kit WordPress plugin through 1.5.7 does not sanitize and escape some widget settings before using them in a SQL statement,... | 2026-09-16 |
| CVE-2026-16592 | low | 2.7 | No | The WP Directory Kit WordPress plugin through 1.5.7 does not check authorization or listing visibility in one of its shortcodes, allowing us... | 2026-09-16 |
| CVE-2026-86756 | medium | 6.1 | No | Snipe-IT 8.5.0 through 8.6.3 contains an open redirect vulnerability in its SAML assertion-consumer endpoint (SamlController::acs, POST /sam... | 2026-09-16 |
| CVE-2026-86755 | medium | 5.4 | No | Snipe-IT versions 4.2.0 through 8.6.3 expose Laravel Passport's auto-registered personal-access-token routes (GET, POST, DELETE /oauth/perso... | 2026-09-16 |
| CVE-2026-86773 | medium | 5.4 | No | Snipe-IT through version 8.6.3 fails to perform object-level authorization in the updateLicense, updateConsumable, updateAccessory, and upda... | 2026-09-16 |
| CVE-2026-92299 | high | 7.4 | No | @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowi... | 2026-09-16 |
| CVE-2026-92256 | medium | 6.5 | No | NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in l2tpd_config_show_cgi.c, ipsec_show_cgi.c, and mod_v... | 2026-09-16 |
| CVE-2026-76873 | medium | 5.2 | No | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in the DHCP dynamic IP display and ARP bind list dis... | 2026-09-16 |
| CVE-2026-76868 | medium | 4.9 | No | Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route_policy_add.cgi caused by a missing exit_port p... | 2026-09-16 |
| CVE-2026-76863 | medium | 4.3 | No | Netcore NR255-V version 1.5.130703 contains a sensitive information disclosure vulnerability in the mod_qos_bandwidth plan.json handling wit... | 2026-09-16 |
| CVE-2026-76858 | medium | 4.8 | No | Netcore NR255-V version 1.5.130703 contains a stored cross-site scripting vulnerability in ddns_wan_list_show.cgi caused by unsafe eval() ha... | 2026-09-16 |
| CVE-2026-76853 | high | 8.1 | No | Netcore NR268 firmware version 1.7.121109 contains a security check bypass vulnerability in the parame_put_file.cgi restore archive prefix v... | 2026-09-16 |
| CVE-2026-92234 | medium | 5.4 | No | QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feat... | 2026-09-16 |
| CVE-2026-91939 | critical | 9.8 | No | Cotonti 1.0.0 Comments plugin passes the ci GET parameter to unserialize() without allowed_classes restriction, allowing unauthenticated att... | 2026-09-16 |
| CVE-2026-81159 | low | 3.7 | No | Observable Timing Discrepancy vulnerability in Drupal Commerce CyberSource allows Brute Force. This issue affects Commerce CyberSource versi... | 2026-09-16 |
| CVE-2026-45767 | medium | 4.4 | No | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.... | 2026-09-16 |
| CVE-2026-45766 | high | 7.5 | No | Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to versions 7.0.... | 2026-09-16 |