Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-116794 | not reported | — | No | russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. From 0.50.0-beta.12 until 0.65.0, the agen... | 2026-10-28 |
| CVE-2026-115281 | medium | 6.8 | No | The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it... | 2026-10-28 |
| CVE-2026-115223 | medium | 4.9 | No | The Smart Popup by Supsystic WordPress plugin before 2.0.2 does not prevent template-injection payloads from being stored in a popup text bl... | 2026-10-28 |
| CVE-2026-115255 | medium | 5.3 | No | The WP Roster WordPress plugin before 2.35 does not perform any capability or nonce checks on one of its AJAX actions, allowing unauthentica... | 2026-10-28 |
| CVE-2026-115225 | medium | 5.8 | No | The Customer Engagement System WordPress plugin before 2.0.2 does not restrict access to its MailChimp interest-group lookup or validate the... | 2026-10-28 |
| CVE-2026-115224 | medium | 4.1 | No | The Customer Engagement System WordPress plugin before 2.0.2 does not safely build the SQL statements that store a popup's page and category... | 2026-10-28 |
| CVE-2026-114491 | medium | 5.3 | No | pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy() restriction to images referenced inside SVG content, allowing attacker... | 2026-10-28 |
| CVE-2026-114265 | medium | 6.3 | No | A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqli_query of the file r... | 2026-10-28 |
| CVE-2026-114262 | high | 7.3 | No | A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the fil... | 2026-10-28 |
| CVE-2026-114133 | medium | 5.4 | No | Nuxt is an open-source web development framework for Vue.js. From 3.13.0 until 4.6.2, the server-island renderer serializes raw useHeadSafe... | 2026-10-28 |
| CVE-2026-114129 | medium | 6.2 | No | stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. From 2.0.0 until 3.7.0, F... | 2026-10-28 |
| CVE-2026-114125 | not reported | — | No | Storybook is a frontend workshop for building user interface components and pages in isolation. From 8.0.0 until 8.6.19, 9.1.21, 10.6.2, and... | 2026-10-28 |
| CVE-2026-114259 | high | 7.3 | No | A flaw has been found in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. This affects the function save... | 2026-10-28 |
| CVE-2026-114121 | medium | 5.4 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.3, 43.7.0, 4... | 2026-10-28 |
| CVE-2026-113813 | medium | 6.5 | No | The PayPlug for WooCommerce (Official) WordPress plugin before 3.1.1 does not perform any capability or ownership check on a set of unauthen... | 2026-10-28 |
| CVE-2026-113494 | low | 2.7 | No | The GeoDirectory WordPress plugin before 2.8.195 does not perform any status or ownership check when rendering a listing referenced by an id... | 2026-10-28 |
| CVE-2026-113488 | medium | 6.8 | No | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before p... | 2026-10-28 |
| CVE-2026-113487 | medium | 6.8 | No | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputtin... | 2026-10-28 |
| CVE-2026-113486 | medium | 6.5 | No | The Media Library Assistant WordPress plugin before 3.42 does not verify a CSRF nonce on its Empty Trash media action, so a forged cross-sit... | 2026-10-28 |
| CVE-2026-113797 | low | 3.1 | No | Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 42.11.1, 43.5.1, 4... | 2026-10-28 |