Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-86806 | high | 7.3 | No | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-... | 2026-09-09 |
| CVE-2026-14989 | high | 7.2 | No | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_... | 2026-09-09 |
| CVE-2026-19778 | medium | 6.5 | No | The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQ... | 2026-09-09 |
| CVE-2026-84908 | medium | 5.3 | No | The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plug... | 2026-09-09 |
| CVE-2026-76009 | high | 8.1 | No | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin... | 2026-09-09 |
| CVE-2026-19945 | medium | 6.4 | No | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to,... | 2026-09-09 |
| CVE-2026-84293 | high | 7.2 | No | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field V... | 2026-09-09 |
| CVE-2026-7804 | medium | 6.1 | No | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter i... | 2026-09-09 |
| CVE-2026-77186 | medium | 6.4 | No | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attrib... | 2026-09-09 |
| CVE-2026-19944 | medium | 4.9 | No | The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and incl... | 2026-09-09 |
| CVE-2026-17553 | high | 7.2 | No | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_aj... | 2026-09-09 |
| CVE-2026-86347 | medium | 6.5 | No | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploa... | 2026-09-09 |
| CVE-2026-86351 | medium | 6.1 | No | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is in... | 2026-09-09 |
| CVE-2026-86408 | medium | 6.5 | No | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view()... | 2026-09-09 |
| CVE-2026-86417 | medium | 4.3 | No | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetch... | 2026-09-09 |
| CVE-2026-86419 | critical | 9.1 | No | Affected versions of MISP contain insufficient validation of server-side outbound HTTP destinations in feed retrieval and TAXII discovery fu... | 2026-09-09 |
| CVE-2026-86440 | medium | 5.4 | No | Affected versions of MISP insufficiently validate URLs used by dashboard widgets, particularly the Button widget. The widget's URL is store... | 2026-09-09 |
| CVE-2026-86441 | medium | 4.3 | No | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several... | 2026-09-09 |
| CVE-2026-86451 | medium | 4.3 | No | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data(... | 2026-09-09 |
| CVE-2026-86342 | medium | 4.3 | No | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlatio... | 2026-09-09 |