Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-77826 | high | 8.8 | No | The RegistrationMagic WordPress plugin before 6.0.9.9 does not verify which application a Facebook access token was issued to before accepti... | 2026-09-08 |
| CVE-2026-19861 | medium | 4.7 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not properly sanitise and escape a form field's value... | 2026-09-08 |
| CVE-2026-19858 | high | 7.5 | No | The JetFormBuilder — Dynamic Blocks Form Builder WordPress plugin before 3.6.5.2 does not perform authorisation checks when resolving reques... | 2026-09-08 |
| CVE-2026-15247 | medium | 5.4 | No | The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one... | 2026-09-08 |
| CVE-2026-85541 | medium | 5.4 | No | DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary J... | 2026-09-08 |
| CVE-2026-85540 | high | 8.8 | No | DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to rea... | 2026-09-08 |
| CVE-2026-84043 | medium | 5.3 | No | The ePayco Payment Gateway for WooCommerce WordPress plugin before 8.4.7 does not properly verify the authenticity of payment confirmation r... | 2026-09-08 |
| CVE-2026-82923 | critical | 9.8 | No | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allow... | 2026-09-08 |
| CVE-2026-85149 | medium | 5.3 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85148 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can explo... | 2026-09-08 |
| CVE-2026-85147 | high | 7.5 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-85146 | critical | 9.8 | No | SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtai... | 2026-09-08 |
| CVE-2026-78234 | critical | 9.9 | No | A flaw was found in hawtio-operator. The operator reads the OpenShift Service CA private signing key from the openshift-service-ca namespace... | 2026-09-08 |
| CVE-2026-77968 | high | 8.2 | No | A flaw was found in hawtio-operator. The operator's ClusterRole grants secrets: [create, get, list, update, watch] across all namespaces. Wh... | 2026-09-08 |
| CVE-2026-86469 | medium | 5.3 | No | A flaw was found in GLib2. When g_file_replace() is used with G_FILE_CREATE_REPLACE_DESTINATION and creating the .goutputstream-XXXXXX tempo... | 2026-09-08 |
| CVE-2026-76925 | medium | 5.8 | No | A flaw was found in Flatpak. A Time-of-check to time-of-use (TOCTOU) race condition exists in the `org.freedesktop.Flatpak.SystemHelper` com... | 2026-09-08 |
| CVE-2026-85769 | medium | 6.5 | No | A flaw was found in libtpms, a library that provides software TPM 2.0 emulation. When restoring TPM 2.0 state (for example during a virtual... | 2026-09-08 |
| CVE-2026-85534 | medium | 5.9 | No | A flaw was found in libsoup. When a client sends an HTTP/2 request body from a non-pollable input stream, the library can buffer more data t... | 2026-09-08 |
| CVE-2026-84185 | medium | 5.9 | No | A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issu... | 2026-09-08 |
| CVE-2026-75021 | high | 8.1 | No | fastify-cli starts the Node.js Inspector when a debug flag is used, but it ignores the explicit bind address the user supplies and binds the... | 2026-09-08 |