Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-19573 | high | 7.2 | No | The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all... | 2026-09-01 |
| CVE-2026-18752 | medium | 6.5 | No | The Persistent Login plugin for WordPress is vulnerable to generic SQL Injection via 'wppl_device_id' Cookie in all versions up to, and incl... | 2026-09-01 |
| CVE-2026-17589 | medium | 4.9 | No | The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to generic SQL Injection via the 'product_order' parameter in all ver... | 2026-09-01 |
| CVE-2026-13203 | medium | 6.4 | No | The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_id' sho... | 2026-09-01 |
| CVE-2026-12747 | medium | 6.4 | No | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all vers... | 2026-09-01 |
| CVE-2026-75865 | critical | 9.8 | No | The WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode plugin for WordPress is vulnerable to arbi... | 2026-09-01 |
| CVE-2026-59270 | critical | 9.1 | No | Spring Security's embedded UnboundID LDAP server (UnboundIdContainer) unconditionally registers an administrative credential and binds its l... | 2026-09-01 |
| CVE-2026-75871 | critical | 9.6 | No | GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.... | 2026-09-01 |
| CVE-2026-77070 | critical | 9.8 | No | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a NoSQL injection vulnerability in the MongoDB node's Find, Delete, and Aggregate operation... | 2026-09-01 |
| CVE-2026-77071 | critical | 9.8 | No | n8n before 1.123.69, 2.33.4, and 2.34.1 contains a PostgREST filter injection vulnerability in the Supabase node's Row Get Many, Delete, and... | 2026-09-01 |
| CVE-2026-65081 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its installation process, where an attacker could cause execution of untrusted code. A... | 2026-09-01 |
| CVE-2026-65098 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its remote-access helper workflow, where an attacker could cause weak authentication.... | 2026-09-01 |
| CVE-2019-3774 | critical | 9.8 | No | Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when rece... | 2026-09-01 |
| CVE-2026-65084 | critical | 9.8 | No | NVIDIA NemoClaw for Linux contains a vulnerability in its deployment process, where an attacker could cause improper certificate validation.... | 2026-09-01 |
| CVE-2026-84149 | not reported | — | No | This vulnerability exists in the ERP system due to exposure of repository information through a publicly accessible .git directory. An unaut... | 2026-09-01 |
| CVE-2026-84148 | not reported | — | No | This vulnerability exists in the ERP system due to improper authentication and authorization controls in the API endpoint. An unauthenticate... | 2026-09-01 |
| CVE-2026-84147 | not reported | — | No | This vulnerability exists in the ERP system due to improper authentication controls and inadequate file type validation at the API endpoint.... | 2026-09-01 |
| CVE-2026-18808 | critical | 9.8 | No | Improper Control of Generation of Code ('Code Injection') vulnerability in Klemsan Electrical Electronics Inc. KIO (Klemsan Internet Objects... | 2026-09-01 |
| CVE-2026-18765 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Teracity Software Technologies Inc. E-... | 2026-09-01 |
| CVE-2026-18210 | critical | 9.8 | No | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in TRtek Technological Products Computer... | 2026-09-01 |