Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116850 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happ... | 2026-10-29 |
| CVE-2026-116857 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-f... | 2026-10-29 |
| CVE-2026-116849 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCast streamcast allows... | 2026-10-29 |
| CVE-2026-116846 | medium | 5.3 | No | Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Contr... | 2026-10-29 |
| CVE-2026-116406 | medium | 4.3 | No | Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Contro... | 2026-10-29 |
| CVE-2026-116402 | medium | 5.3 | No | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows C... | 2026-10-29 |
| CVE-2026-116399 | high | 8.8 | No | Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request Forgery.This issue affe... | 2026-10-29 |
| CVE-2026-116206 | medium | 6.4 | No | YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject script into c... | 2026-10-29 |
| CVE-2026-116202 | medium | 5.4 | No | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability that allows low-privilege authenticated users to upload unsanitize... | 2026-10-29 |
| CVE-2026-116198 | medium | 4.3 | No | Snipe-IT before 8.7.0 contains a missing encryption vulnerability in Api\AssetsController::store that writes plaintext into encrypted-flagge... | 2026-10-29 |
| CVE-2026-116194 | medium | 6.8 | No | Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost OAuth callback, which... | 2026-10-29 |
| CVE-2026-116190 | low | 3.7 | No | rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards operator-configured... | 2026-10-29 |
| CVE-2026-116186 | not reported | — | No | OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on inbound edge gateway events... | 2026-10-29 |
| CVE-2026-116182 | medium | 5.0 | No | phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches external images reference... | 2026-10-29 |
| CVE-2026-116174 | high | 7.5 | No | vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and GenerateStream service that... | 2026-10-29 |
| CVE-2026-116170 | medium | 4.9 | No | SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by injecting unescaped op an... | 2026-10-29 |
| CVE-2026-116166 | medium | 6.8 | No | SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port keeps serving full API... | 2026-10-29 |
| CVE-2026-116162 | not reported | — | No | Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when issuing an SMS multi-... | 2026-10-29 |
| CVE-2026-116142 | low | 3.3 | No | ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond allocated memory when printi... | 2026-10-29 |
| CVE-2026-116137 | low | 3.7 | No | adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries() check by using canonical... | 2026-10-29 |