Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-70084 | medium | 5.5 | No | Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-70086 | high | 7.0 | No | Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally. | 2026-10-28 |
| CVE-2026-70089 | high | 8.8 | No | Heap-based buffer overflow in Windows GDI allows an unauthorized attacker to execute code over a network. | 2026-10-28 |
| CVE-2026-70090 | medium | 5.5 | No | Use of uninitialized resource in Windows Netlogon allows an authorized attacker to disclose information locally. | 2026-10-28 |
| CVE-2026-92098 | medium | 6.1 | No | The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'l10n_prin... | 2026-10-28 |
| CVE-2026-81212 | critical | 10.0 | No | IBM DataStage on Cloud Pak for Data 5.4.0.0 allows an unauthenticated user to perform an arbitrary write into shared Redis under any tenant'... | 2026-10-28 |
| CVE-2026-56828 | high | 8.8 | No | Shopper is a Headless e-commerce Admin Panel. From 2.8.0 until 2.8.1, three Shopper Livewire admin components retain authorization gaps afte... | 2026-10-28 |
| CVE-2026-59185 | high | 8.5 | No | identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes. Prior to 1.0.2, the default-on `POST /v1/workspaces/... | 2026-10-28 |
| CVE-2026-59172 | high | 7.8 | No | Joker is a small Clojure interpreter, linter and formatter written in Go. Prior to 1.8.2, `joker --lint ` walks upward from the linted file... | 2026-10-28 |
| CVE-2026-76058 | medium | 5.3 | No | The PayPal Brasil para WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.8. T... | 2026-10-28 |
| CVE-2026-118164 | medium | 6.4 | No | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting... | 2026-10-28 |
| CVE-2026-115968 | critical | 9.8 | No | Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object Injection.This issue affect... | 2026-10-28 |
| CVE-2026-116393 | high | 7.5 | No | Missing Authorization vulnerability in iHomefinder, Inc. Optima Express optima-express allows Exploiting Incorrectly Configured Access Contr... | 2026-10-28 |
| CVE-2026-115612 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP slicewp allows Stor... | 2026-10-28 |
| CVE-2026-115596 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerce Product Catalog ec... | 2026-10-28 |
| CVE-2026-116610 | medium | 4.3 | No | The Clean Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.20.1 due to a missing capabi... | 2026-10-28 |
| CVE-2026-114094 | high | 8.8 | No | Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing arbitrary file write. Attack... | 2026-10-28 |
| CVE-2026-114089 | high | 8.8 | No | Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because loading /account/aut... | 2026-10-28 |
| CVE-2026-114086 | medium | 5.3 | No | Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that allows unauthenticated at... | 2026-10-28 |
| CVE-2026-114084 | high | 7.7 | No | Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates the unescaped tags qu... | 2026-10-28 |