Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-106647 | low | 3.8 | No | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not scope a contact form's email delivery configuration to the form's o... | 2026-10-28 |
| CVE-2026-106003 | medium | 5.3 | No | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorization, authentication or nonce validation on one of its AJ... | 2026-10-28 |
| CVE-2026-106002 | medium | 5.3 | No | The Court Reservation WordPress plugin before 1.12.4 does not perform any authorisation or nonce verification on one of its challenge-manage... | 2026-10-28 |
| CVE-2026-105997 | medium | 5.3 | No | The Booking Package WordPress plugin before 1.7.33 does not restrict who can trigger its booking verification-code emails nor bind the recip... | 2026-10-28 |
| CVE-2026-105972 | high | 7.5 | No | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in it... | 2026-10-28 |
| CVE-2026-104694 | medium | 6.8 | No | The Thrive Automator WordPress plugin before 11.2 does not properly sanitize and escape a parameter's array key before using it in a SQL que... | 2026-10-28 |
| CVE-2026-103688 | critical | 9.8 | No | The Checkout Files Upload for WooCommerce WordPress plugin before 2.4.0 does not validate uploaded file types when its accepted file types s... | 2026-10-28 |
| CVE-2026-103382 | medium | 5.3 | No | The Casso Flow WordPress plugin before 4.2.0 does not properly authenticate incoming bank-transfer payment notifications, as the token used... | 2026-10-28 |
| CVE-2026-103372 | medium | 5.3 | No | The Payconiq WordPress plugin through 1.0.4 does not check that a visitor is allowed to see an order before returning its confirmation link,... | 2026-10-28 |
| CVE-2026-103359 | medium | 5.3 | No | The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming payment notifications a... | 2026-10-28 |
| CVE-2026-103330 | medium | 5.3 | No | The Sadad QA Payment WordPress plugin through 1.28 does not correctly verify the authenticity of incoming payment notifications, as the veri... | 2026-10-28 |
| CVE-2026-103313 | medium | 5.3 | No | The BitPay Gateway for WooCommerce WordPress plugin through 4.1.3 does not bind the payment provider's transaction confirmation to the order... | 2026-10-28 |
| CVE-2026-103331 | medium | 5.3 | No | The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications,... | 2026-10-28 |
| CVE-2026-103325 | low | 3.7 | No | The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its payment webhook, validati... | 2026-10-28 |
| CVE-2026-103332 | medium | 5.3 | No | The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of incoming payment noti... | 2026-10-28 |
| CVE-2026-103312 | medium | 5.3 | No | The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment notifications on a stock i... | 2026-10-28 |
| CVE-2026-102834 | high | 7.5 | No | JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit bu... | 2026-10-28 |
| CVE-2017-20287 | high | 7.5 | No | Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary f... | 2026-10-28 |
| CVE-2026-78459 | high | 7.8 | No | Heap-based buffer overflow in Windows Internet Information Services allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-83511 | high | 7.4 | No | Weak authentication in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network. | 2026-10-28 |