Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-15402 | medium | 6.4 | No | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scr... | 2026-09-16 |
| CVE-2026-11996 | medium | 6.4 | No | The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions u... | 2026-09-16 |
| CVE-2026-11984 | medium | 5.3 | No | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including,... | 2026-09-16 |
| CVE-2026-68534 | not reported | — | No | Concrete CMS before 9.5.3 rendered Express entry labels as raw HTML when displaying associated entries, resulting in stored cross-site scrip... | 2026-09-16 |
| CVE-2026-68533 | not reported | — | No | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message A... | 2026-09-16 |
| CVE-2026-68531 | not reported | — | No | Concrete CMS 9 before 9.5.3 did not escape SQL LIKE wildcard characters in the keyword search filters used by the file manager, file folders... | 2026-09-16 |
| CVE-2026-68530 | not reported | — | No | Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. T... | 2026-09-16 |
| CVE-2026-68529 | not reported | — | No | Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_se... | 2026-09-16 |
| CVE-2026-18421 | not reported | — | No | Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update... | 2026-09-16 |
| CVE-2026-81899 | not reported | — | No | Concrete CMS 9.0.0 to 9.5.2 stored group folder names without sanitization and printed them unescaped on the Members > Groups dashboard page... | 2026-09-16 |
| CVE-2026-18115 | not reported | — | No | Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.... | 2026-09-16 |
| CVE-2026-78547 | not reported | — | No | Out-of-bounds write vulnerability in Citrix Citrix Workspace app for Windows. This issue affects Citrix Workspace app for Windows: before 2... | 2026-09-16 |
| CVE-2026-78546 | not reported | — | No | Out-of-bounds read vulnerability in Citirx Workspace app for Windows. This issue affects Workspace app for Windows: before 2603.11 Current... | 2026-09-16 |
| CVE-2026-89160 | medium | 6.5 | No | PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject. | 2026-09-16 |
| CVE-2026-27562 | high | 7.2 | No | A high-privileged remote attacker can exploit a command injection vulnerability in the /api/iodd/config endpoint by sending a crafted PUT re... | 2026-09-16 |
| CVE-2026-27557 | high | 7.5 | No | An unauthenticated remote attacker can exploit a path traversal vulnerability in the /index.php/view_uploaded_iodd_file endpoint allowing th... | 2026-09-16 |
| CVE-2026-27552 | high | 8.1 | No | A low-privileged remote attacker can exploit improper authorization in the /index.php/attached_devices_tab/do_upload endpoint to upload IODD... | 2026-09-16 |
| CVE-2026-27547 | high | 8.8 | No | A low-privileged remote attacker can exploit a command injection vulnerability in the /index.php/ajax/get_iodd_menu_info endpoint using vali... | 2026-09-16 |
| CVE-2026-21588 | not reported | — | No | This High severity DoS (Denial of Service) vulnerability was introduced in versions 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2,... | 2026-09-16 |
| CVE-2026-89161 | high | 7.8 | No | In PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can... | 2026-09-16 |