Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-111737 | low | 3.5 | No | The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of fro... | 2026-10-23 |
| CVE-2026-110537 | low | 3.8 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not verify that an administrator may manage the specific user accounts... | 2026-10-23 |
| CVE-2026-110510 | low | 3.5 | No | The Essential Addons for Elementor WordPress plugin before 6.8.7 does not validate the HTML tag setting of some of its widgets before using... | 2026-10-23 |
| CVE-2026-109936 | high | 7.5 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while render... | 2026-10-23 |
| CVE-2026-109934 | medium | 5.3 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data th... | 2026-10-23 |
| CVE-2026-109933 | medium | 6.8 | No | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them... | 2026-10-23 |
| CVE-2026-115497 | high | 7.5 | No | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7... | 2026-10-23 |
| CVE-2026-109198 | high | 7.2 | No | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user... | 2026-10-23 |
| CVE-2026-113682 | high | 7.4 | No | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated a... | 2026-10-23 |
| CVE-2026-113600 | medium | 5.4 | No | Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete ot... | 2026-10-23 |
| CVE-2026-113595 | medium | 4.3 | No | Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated m... | 2026-10-23 |
| CVE-2026-111693 | critical | 9.8 | No | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain adm... | 2026-10-23 |
| CVE-2026-111683 | medium | 5.4 | No | Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model p... | 2026-10-23 |
| CVE-2026-6103 | low | 3.3 | No | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and... | 2026-10-23 |
| CVE-2019-15598 | critical | 9.8 | No | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the c... | 2026-10-23 |
| CVE-2026-91765 | high | 7.5 | No | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SO... | 2026-10-23 |
| CVE-2026-91766 | medium | 5.9 | No | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers uncha... | 2026-10-23 |
| CVE-2026-91769 | medium | 4.3 | No | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to t... | 2026-10-23 |
| CVE-2026-99087 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used I... | 2026-10-23 |
| CVE-2026-99086 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume()... | 2026-10-23 |