Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-73444 | medium | 4.7 | No | On affected platforms running Arista EOS with VRRPv2 IP Authentication Header (IP-AH) authentication configured, an unauthenticated attacker... | 2026-09-16 |
| CVE-2026-73438 | medium | 5.3 | No | On affected platforms running Arista EOS with Open Shortest Path First version 3 (OSPFv3) configured, an unauthenticated attacker on the sam... | 2026-09-16 |
| CVE-2026-5920 | medium | 6.4 | No | The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shortcode_content' parameter of the bt_bb_s... | 2026-09-16 |
| CVE-2026-27565 | critical | 9.8 | No | An unauthenticated remote attacker can upload a malicious IODD file that places and executes a shell script with root privileges. The shell... | 2026-09-16 |
| CVE-2026-27564 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/datastorage/data endpoint by sending a PUT reque... | 2026-09-16 |
| CVE-2026-27561 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted GET re... | 2026-09-16 |
| CVE-2026-27560 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted DELETE... | 2026-09-16 |
| CVE-2026-27559 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /api/status/data endpoint by sending a crafted GET req... | 2026-09-16 |
| CVE-2026-27556 | high | 8.8 | No | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using... | 2026-09-16 |
| CVE-2026-27555 | high | 8.8 | No | A low-privileged remote attacker can exploit a local file inclusion vulnerability in the /index.php/ajax/get_iodd_port_info endpoint using a... | 2026-09-16 |
| CVE-2026-27554 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/save_iodd_parameters endpoint using op... | 2026-09-16 |
| CVE-2026-27551 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/parameterManage endpoint using user cr... | 2026-09-16 |
| CVE-2026-27550 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the Field_Shadow_Password class using operator credentials... | 2026-09-16 |
| CVE-2026-27549 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/attached_devices_tab/do_upload endpoint usi... | 2026-09-16 |
| CVE-2026-27546 | critical | 9.8 | No | An unauthenticated remote attacker can exploit an authentication bypass in the _account_log function to log in as an admin, even when accoun... | 2026-09-16 |
| CVE-2026-18595 | high | 7.2 | No | The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all... | 2026-09-16 |
| CVE-2026-19655 | medium | 6.5 | No | On affected platforms running Arista EOS with Dynamic Host Configuration Protocol (DHCP) relay/snooping configured with the information opti... | 2026-09-16 |
| CVE-2026-19729 | medium | 4.9 | No | A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak.... | 2026-09-16 |
| CVE-2026-14349 | critical | 9.8 | No | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to,... | 2026-09-16 |
| CVE-2026-15609 | medium | 6.4 | No | The Bridge - Creative Multipurpose WordPress Theme theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'circle_line' Shortc... | 2026-09-16 |