Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-79570 | critical | 9.8 | No | mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vuln... | 2026-09-09 |
| CVE-2026-78742 | medium | 6.1 | No | Silverpeas Core <=6.4.6 is vulnerable to Cross Site Scripting (XSS) via the Multimedia library application introduction. | 2026-09-09 |
| CVE-2026-75905 | medium | 4.3 | No | The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to... | 2026-09-09 |
| CVE-2026-75861 | medium | 6.5 | No | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended r... | 2026-09-09 |
| CVE-2026-74859 | medium | 6.8 | No | The shell theme installer in gnome-tweaks extracts user-supplied ZIP archives without validating archive member paths. As a result, a crafte... | 2026-09-09 |
| CVE-2026-67367 | high | 8.6 | No | A vulnerability has been identified in SIMOVE Fleetmanager V3.1 (All versions < V3.1.13), SIMOVE Fleetmanager V3.2 (All versions < V3.2.4),... | 2026-09-09 |
| CVE-2026-62649 | high | 7.5 | No | A vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). The web server does not properly limit or manage system resourc... | 2026-09-09 |
| CVE-2026-58113 | medium | 6.1 | No | A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcente... | 2026-09-09 |
| CVE-2026-55512 | medium | 5.3 | No | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.2.0 to before version 0.5.0, when OIDC is enabled, GET... | 2026-09-09 |
| CVE-2026-19855 | medium | 6.5 | No | The CleanTalk WordPress plugin before 6.87 does not prevent unauthenticated, user-supplied comment content from being passed to WordPress's... | 2026-09-09 |
| CVE-2026-19802 | medium | 4.3 | No | The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc... | 2026-09-09 |
| CVE-2026-19800 | medium | 4.9 | No | The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to SQL Injection via t... | 2026-09-09 |
| CVE-2026-3174 | high | 7.5 | No | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check... | 2026-09-09 |
| CVE-2026-18042 | medium | 5.3 | No | The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its f... | 2026-09-09 |
| CVE-2026-16960 | high | 7.5 | No | The Loops & Logic WordPress plugin before 4.3.0 does not restrict its public template-data action to the data a visitor is permitted to see,... | 2026-09-09 |
| CVE-2026-15667 | high | 7.5 | No | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion... | 2026-09-09 |
| CVE-2026-14359 | high | 8.8 | No | The YITH WooCommerce Waitlist Premium plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 3.35.0. T... | 2026-09-09 |
| CVE-2026-14962 | high | 8.6 | No | The ELEX WooCommerce Request a Quote WordPress plugin before 2.4.1 does not properly sanitise and escape a parameter before using it in a SQ... | 2026-09-09 |
| CVE-2026-13146 | low | 3.7 | No | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester owns the booking targeted by its bank-deposit slip... | 2026-09-09 |
| CVE-2026-13144 | low | 3.7 | No | The WP Travel WordPress plugin before 12.0.2 does not properly verify that the requester is authorized to modify the targeted booking on one... | 2026-09-09 |