Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-109936 | high | 7.5 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly bound a pattern it uses to rewrite its dynamic-content tokens while render... | 2026-10-23 |
| CVE-2026-109934 | medium | 5.3 | No | The Otter Blocks WordPress plugin before 3.2.8 does not correctly determine whether a post is publicly readable before returning its data th... | 2026-10-23 |
| CVE-2026-109933 | medium | 6.8 | No | The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them... | 2026-10-23 |
| CVE-2026-115497 | high | 7.5 | No | The Music Store – WordPress eCommerce plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.4.7... | 2026-10-23 |
| CVE-2026-109198 | high | 7.2 | No | The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user... | 2026-10-23 |
| CVE-2026-113682 | high | 7.4 | No | Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that allows unauthenticated a... | 2026-10-23 |
| CVE-2026-113600 | medium | 5.4 | No | Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users to modify or delete ot... | 2026-10-23 |
| CVE-2026-113595 | medium | 4.3 | No | Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated m... | 2026-10-23 |
| CVE-2026-111693 | critical | 9.8 | No | DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain adm... | 2026-10-23 |
| CVE-2026-111683 | medium | 5.4 | No | Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model p... | 2026-10-23 |
| CVE-2026-6103 | low | 3.3 | No | phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and... | 2026-10-23 |
| CVE-2019-15598 | critical | 9.8 | No | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the c... | 2026-10-23 |
| CVE-2026-91765 | high | 7.5 | No | cleanup_xml_node() in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SO... | 2026-10-23 |
| CVE-2026-91766 | medium | 5.9 | No | When the http:// stream wrapper follows a redirect it forwards the user-supplied Authorization, Cookie and Proxy-Authorization headers uncha... | 2026-10-23 |
| CVE-2026-91769 | medium | 4.3 | No | PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to t... | 2026-10-23 |
| CVE-2026-99087 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used I... | 2026-10-23 |
| CVE-2026-99086 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dm_integrity_resume()... | 2026-10-23 |
| CVE-2026-99085 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF... | 2026-10-23 |
| CVE-2026-99084 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iterate_dir() ta... | 2026-10-23 |
| CVE-2026-99076 | not reported | — | No | In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when IC... | 2026-10-23 |