Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-108686 | low | 3.7 | No | The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors, allowing unauthenticated... | 2026-10-29 |
| CVE-2026-108685 | low | 3.7 | No | The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its profile during front-end re... | 2026-10-29 |
| CVE-2026-105258 | low | 3.5 | No | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering the... | 2026-10-29 |
| CVE-2026-103693 | critical | 9.0 | No | The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an unauthenticated user fro... | 2026-10-29 |
| CVE-2024-3586 | low | 3.5 | No | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such... | 2026-10-29 |
| CVE-2026-86016 | high | 8.2 | No | VNote is a note-taking platform. Prior to 4.3.0, VNote uses the assignment `preNode.innerHTML = p_metaData` in src/data/extra/web/js/markdow... | 2026-10-29 |
| CVE-2026-75524 | medium | 5.4 | No | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 2.2.2, an attac... | 2026-10-29 |
| CVE-2026-77564 | low | 3.3 | No | Talos Linux is a Linux distribution built for Kubernetes deployments. Prior to 1.12.9 and 1.13.3, talosctl support includes the auth field f... | 2026-10-29 |
| CVE-2026-54668 | not reported | — | No | Kitodo.Production is a workflow management tool for mass digitization and is part of the Kitodo Digital Library Suite. Prior to version 3.9.... | 2026-10-29 |
| CVE-2026-67414 | not reported | — | No | RabbitMQ is a messaging and streaming broker. From 4.0.0 until 4.0.24, 4.1.15, 4.2.10, and 4.3.4, deps/amqp10_common/src/amqp10_binary_parse... | 2026-10-29 |
| CVE-2026-19610 | medium | 6.5 | No | A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics and configurations. The... | 2026-10-29 |
| CVE-2026-117611 | not reported | — | No | Improper certificate validation in Checkmk | 2026-10-29 |
| CVE-2026-118030 | medium | 4.2 | No | A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and access management serv... | 2026-10-29 |
| CVE-2026-116010 | medium | 4.3 | No | RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write records for students out... | 2026-10-29 |
| CVE-2026-115892 | not reported | — | No | Wasmtime is a runtime for WebAssembly. From 46.0.0 until 48.0.7 and 49.0.4, lowering a host-created component-model stream or future into a... | 2026-10-29 |
| CVE-2026-115885 | not reported | — | No | The LangGraph CLI is the official command-line interface for LangGraph. From 0.4.15 until 0.4.32, langgraph deploy --verbose passes a tempor... | 2026-10-29 |
| CVE-2026-115877 | medium | 5.4 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.web.http.HTTPChannel.hea... | 2026-10-29 |
| CVE-2026-115810 | high | 7.7 | No | Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows authenticated low-privi... | 2026-10-29 |
| CVE-2026-115802 | medium | 4.3 | No | A weakness has been identified in InternScience InternAgent 1.5.0. This affects the function train of the file tasks/AutoChem/code/experimen... | 2026-10-29 |
| CVE-2026-115774 | medium | 4.9 | No | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 26.10.0rc1, twisted.mail.imap4.IMAP4Server r... | 2026-10-29 |