Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-87827 | not reported | — | No | Certain KGUARD DVR devices running vulnerable firmware expose a system command execution service on all network interfaces without requiring... | 2026-09-09 |
| CVE-2026-78377 | medium | 6.1 | No | URL redirection to untrusted site ('open redirect') vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Syst... | 2026-09-09 |
| CVE-2026-19733 | medium | 5.3 | No | Server-Side request forgery (SSRF) vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Industry and... | 2026-09-09 |
| CVE-2026-11838 | medium | 4.3 | No | Missing authentication for critical function vulnerability in Yordam Informatics Technology Consulting, Training, and Electronic Systems Ind... | 2026-09-09 |
| CVE-2026-76801 | high | 8.8 | No | The FireBox – WooCommerce Popup Builder, Exit Intent Popup, Email Optin & Cart Abandonment plugin for WordPress is vulnerable to Remote Code... | 2026-09-09 |
| CVE-2026-13709 | medium | 6.4 | No | The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iq_tree_tree_chart_tem... | 2026-09-09 |
| CVE-2026-12956 | medium | 5.3 | No | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the... | 2026-09-09 |
| CVE-2026-86806 | high | 7.3 | No | A weakness has been identified in opengeos GeoLibre up to 2.3.0. Impacted is the function _is_within_roots. This manipulation causes server-... | 2026-09-09 |
| CVE-2026-14989 | high | 7.2 | No | The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpl_user_... | 2026-09-09 |
| CVE-2026-19778 | medium | 6.5 | No | The WPMR Google Feed Manager for WooCommerce – Sell on Google Merchant Center & Shopping plugin for WordPress is vulnerable to time-based SQ... | 2026-09-09 |
| CVE-2026-84908 | medium | 5.3 | No | The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plug... | 2026-09-09 |
| CVE-2026-76009 | high | 8.1 | No | The Next-Cart Store to WooCommerce Migration plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and includin... | 2026-09-09 |
| CVE-2026-19945 | medium | 6.4 | No | The WP Crowdfunding plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to,... | 2026-09-09 |
| CVE-2026-84293 | high | 7.2 | No | The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field V... | 2026-09-09 |
| CVE-2026-7804 | medium | 6.1 | No | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wpf_fid' parameter i... | 2026-09-09 |
| CVE-2026-77186 | medium | 6.4 | No | The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attrib... | 2026-09-09 |
| CVE-2026-19944 | medium | 4.9 | No | The WP Crowdfunding plugin for WordPress is vulnerable to generic SQL Injection via 'wpneo_reward' Post Meta in all versions up to, and incl... | 2026-09-09 |
| CVE-2026-17553 | high | 7.2 | No | The WP EasyCart plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.9.3. This is due to the ec_aj... | 2026-09-09 |
| CVE-2026-86347 | medium | 6.5 | No | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploa... | 2026-09-09 |
| CVE-2026-86351 | medium | 6.1 | No | Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is in... | 2026-09-09 |