Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-75670 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-75651 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-09-11 |
| CVE-2026-77108 | high | 7.5 | No | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage... | 2026-09-11 |
| CVE-2026-73017 | high | 7.5 | No | Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to execute code locally. | 2026-09-11 |
| CVE-2026-62140 | medium | 5.3 | No | Unauthenticated Insecure Direct Object References (IDOR) in Quiz And Survey Master <= 11.2.5 versions. | 2026-09-11 |
| CVE-2026-6642 | medium | 6.4 | No | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bulk edit preset export/import mechani... | 2026-09-11 |
| CVE-2026-71440 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-09-11 |
| CVE-2026-62137 | medium | 5.3 | No | Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. | 2026-09-11 |
| CVE-2026-62136 | medium | 5.3 | No | Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions. | 2026-09-11 |
| CVE-2026-62135 | medium | 5.3 | No | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. | 2026-09-11 |
| CVE-2026-62132 | medium | 5.3 | No | Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. | 2026-09-11 |
| CVE-2026-62114 | medium | 5.3 | No | Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. | 2026-09-11 |
| CVE-2026-62113 | medium | 4.3 | No | Contributor Insecure Direct Object References (IDOR) in Slim SEO <= 4.10.0 versions. | 2026-09-11 |
| CVE-2026-62110 | medium | 6.5 | No | Contributor Cross Site Scripting (XSS) in Bold Page Builder <= 5.9.9 versions. | 2026-09-11 |
| CVE-2026-62109 | high | 7.6 | No | Editor SQL Injection in Sky Addons for Elementor <= 3.8.4 versions. | 2026-09-11 |
| CVE-2026-62107 | high | 8.8 | No | Unauthenticated PHP Object Injection in Masteriyo - LMS <= 3.4.0 versions. | 2026-09-11 |
| CVE-2026-62103 | critical | 9.8 | No | Unauthenticated PHP Object Injection in Everest Forms <= 3.6.0 versions. | 2026-09-11 |
| CVE-2026-62102 | high | 8.8 | No | Subscriber Privilege Escalation in Gato GraphQL <= 19.2.3 versions. | 2026-09-11 |
| CVE-2026-62089 | high | 7.1 | No | Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for... | 2026-09-11 |
| CVE-2026-62088 | medium | 5.3 | No | Insertion of Sensitive Information Into Sent Data vulnerability in 10up ElasticPress allows Retrieve Embedded Sensitive Data. This issue af... | 2026-09-11 |