Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19704 | medium | 5.3 | No | The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inje... | 2026-09-03 |
| CVE-2026-19453 | high | 7.1 | No | The JetBackup WordPress plugin before 3.1.23.5 does not verify the role or capabilities of the account it preserves across a restore or migr... | 2026-09-03 |
| CVE-2026-19251 | medium | 5.3 | No | The Ultimate Member WordPress plugin before 2.13.0 does not check whether a comment has been approved, or whether the profile it belongs to... | 2026-09-03 |
| CVE-2026-19116 | high | 8.8 | No | The User Frontend WordPress plugin before 4.3.11 does not prevent user-supplied field values from being deserialized when a submitted post i... | 2026-09-03 |
| CVE-2023-3360 | low | 3.3 | No | The Weaver Show Posts WordPress plugin before 1.8.1 unserialises the content of an imported file, which could lead to PHP object injections... | 2026-09-03 |
| CVE-2026-82182 | medium | 4.1 | No | The WPvivid — Backup, Migration & Staging WordPress plugin before 0.9.133 does not sanitise a user supplied list of identifiers before using... | 2026-09-03 |
| CVE-2026-16983 | medium | 4.3 | No | The Gutentor WordPress plugin before 4.0.6 does not apply the correct context restriction to one of its REST endpoints, exposing the plainte... | 2026-09-03 |
| CVE-2026-16966 | medium | 5.3 | No | The Solace Extra WordPress plugin before 1.7.0 does not perform any authorization or post-status checks in one of its AJAX actions, allowing... | 2026-09-03 |
| CVE-2026-15232 | medium | 5.3 | No | The MotoPress Appointment Booking WordPress plugin before 2.4.8 does not perform an authorization or ownership check when handling a user-su... | 2026-09-03 |
| CVE-2026-14215 | medium | 6.5 | No | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token befo... | 2026-09-03 |
| CVE-2026-12865 | high | 7.1 | No | The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute... | 2026-09-03 |
| CVE-2026-12526 | high | 8.1 | No | The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.7 does not verify that the requester is authorized to edit the targeted u... | 2026-09-03 |
| CVE-2026-79991 | not reported | — | No | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager... | 2026-09-03 |
| CVE-2026-79990 | not reported | — | No | Craft CMS GraphQL entry mutation resolvers (saveEntry, deleteEntry) read siteIddirectly from$argumentswithout passing throughArgumentManager... | 2026-09-03 |
| CVE-2026-84350 | high | 8.8 | No | Use after free in TabStrip in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitr... | 2026-09-03 |
| CVE-2026-84351 | high | 8.3 | No | Buffer overflow in GPU in Google Chrome on on Windows prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer proc... | 2026-09-03 |
| CVE-2026-84354 | critical | 9.6 | No | Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to exe... | 2026-09-03 |
| CVE-2026-84355 | low | 3.1 | No | Incorrect authorization in Navigation in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer pro... | 2026-09-03 |
| CVE-2026-80254 | medium | 6.5 | No | Authorization bypass through user-controlled key issue exists in ShizenBox2 (edge-app). If exploited, an attacker who can log in to the prod... | 2026-09-03 |
| CVE-2026-80253 | medium | 6.8 | No | An improper physical access control issue exists in ShizenBox2 (dev-conf). If exploited, an attacker with physical access to the product may... | 2026-09-03 |