Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2024-44647 | medium | 6.1 | No | PHPGurukul Small CRM 3.0 is vulnerable to Cross Site Scripting (XSS) via the aremark parameter in manage-tickets.php. | 2026-10-27 |
| CVE-2024-55016 | medium | 6.5 | No | PHPGurukul Student Record Management System 3.20 is vulnerable to SQL Injection via the id and password parameters in login.php. | 2026-10-27 |
| CVE-2024-44639 | medium | 6.5 | No | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the sub1, sub2, sub3, sub4, and course-short parameters in add-subj... | 2026-10-27 |
| CVE-2024-44636 | medium | 6.5 | No | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the adminname and aemailid parameters in /admin-profile.php. | 2026-10-27 |
| CVE-2024-44635 | medium | 6.1 | No | PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting (XSS) via adminname and aemailid parameters in /admin-profile.ph... | 2026-10-27 |
| CVE-2024-44632 | medium | 6.5 | No | PHPGurukul Student Record System 3.20 is vulnerable to SQL Injection via the id and emailid parameters in password-recovery.php. | 2026-10-27 |
| CVE-2024-5200 | medium | 4.8 | No | The Postie WordPress plugin before 1.9.71 does not sanitise and escape some of its settings, which could allow high privilege users such as... | 2026-10-27 |
| CVE-2024-45431 | medium | 5.3 | No | OpenSynergy BlueSDK (aka Blue SDK) through 6.x has Improper Input Validation. The specific flaw exists within the BlueSDK Bluetooth stack. T... | 2026-10-27 |
| CVE-2024-36346 | medium | 6.0 | No | Improper input validation in AMD Power Management Firmware (PMFW) could allow a privileged attacker from Guest VM to send arbitrary input da... | 2026-10-27 |
| CVE-2024-36342 | high | 8.8 | No | Improper input validation in the GPU driver could allow an attacker to exploit a heap overflow potentially resulting in arbitrary code execu... | 2026-10-27 |
| CVE-2024-12145 | medium | 4.3 | No | The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the b... | 2026-10-27 |
| CVE-2024-58382 | high | 7.5 | No | league/commonmark versions before 2.6.0 contain polynomial time complexity vulnerabilities in Markdown parsing that allow attackers to cause... | 2026-10-27 |
| CVE-2024-58381 | high | 7.5 | No | PocketMine-MP before 5.11.1 contains a denial of service vulnerability in LoginPacket JSON processing that allows remote attackers to crash... | 2026-10-27 |
| CVE-2024-58380 | medium | 6.5 | No | PocketMine-MP versions before 5.11.2 contain a denial of service vulnerability in BookEditPacket handling that crashes the server when an in... | 2026-10-27 |
| CVE-2024-11080 | critical | 9.8 | No | The Post Grid and Gutenberg Blocks – ComboBlocks plugin for WordPress is vulnerable to Unauthenticated Hook Injection in versions 2.2.32 to... | 2026-10-27 |
| CVE-2024-7956 | not reported | — | No | A vulnerability exists in the affected products that allows a threat actor to gain access to user’s projects. To exploit this vulnerability... | 2026-10-27 |
| CVE-2024-3773 | medium | 5.9 | No | The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting the... | 2026-10-27 |
| CVE-2024-35585 | high | 8.6 | No | Oxford Nanopore MinKNOW before 24.06 relies on a client's source IP address for authentication. | 2026-10-27 |
| CVE-2024-7952 | not reported | — | No | A data exposure vulnerability exists in the affected product. There are hardcoded links in the source code that lead to JSON files that can... | 2026-10-27 |
| CVE-2024-14047 | high | 7.1 | No | A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A... | 2026-10-27 |