Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-114370 | low | 3.7 | No | A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files fro... | 2026-10-22 |
| CVE-2026-17557 | medium | 6.5 | No | A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job,... | 2026-10-22 |
| CVE-2026-113161 | high | 8.8 | No | Use after free in WebRTC in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via... | 2026-10-22 |
| CVE-2026-98128 | medium | 5.5 | No | In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()... | 2026-10-22 |
| CVE-2026-97328 | high | 7.5 | No | The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a... | 2026-10-22 |
| CVE-2026-88849 | low | 2.7 | No | The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.55 does not verify that a user targeted through its student-enrolment featu... | 2026-10-22 |
| CVE-2026-78392 | medium | 6.8 | No | The Link Library WordPress plugin before 7.9.6 does not sanitise and escape a link field before outputting it inside an attribute of a link... | 2026-10-22 |
| CVE-2026-111972 | medium | 4.9 | No | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not verify that a user is authorised to act on the targete... | 2026-10-22 |
| CVE-2026-111971 | medium | 6.8 | No | The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.5.8 does not sanitise and escape collection and gallery names befor... | 2026-10-22 |
| CVE-2026-111958 | high | 7.5 | No | The Royal MCP WordPress plugin before 1.5.7 does not limit a preview-link token to the single preview it was issued for, so any party that o... | 2026-10-22 |
| CVE-2026-110011 | low | 2.7 | No | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform a capability check in its export feature, allow... | 2026-10-22 |
| CVE-2026-110010 | medium | 4.8 | No | The MB Custom Post Types & Custom Taxonomies WordPress plugin before 2.12.3 does not perform any capability or authentication check before a... | 2026-10-22 |
| CVE-2026-109987 | high | 7.2 | No | The PixelYourSite WordPress plugin before 11.4.3, PixelYourSite Pro WordPress plugin before 12.6.8 do not sanitise and escape a cookie value... | 2026-10-22 |
| CVE-2026-109931 | low | 3.7 | No | The Infility Global WordPress plugin before 2.16.25 does not perform any authorisation or nonce check on an AJAX action available to unauthe... | 2026-10-22 |
| CVE-2026-109927 | high | 7.2 | No | The HIPAA Forms WordPress plugin before 3.3.2 does not perform a capability check when handling a request that rebuilds its own custom user... | 2026-10-22 |
| CVE-2026-103234 | medium | 4.8 | No | The WP Ultimate Review WordPress plugin before 2.4.5 does not neutralise shortcodes in all of the review fields submitted through its public... | 2026-10-22 |
| CVE-2026-100142 | medium | 5.3 | No | The FluentCart A New Era of eCommerce WordPress plugin before 2.2.0 does not verify that a stored customer address selected during checkout... | 2026-10-22 |
| CVE-2026-112842 | medium | 6.5 | No | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configur... | 2026-10-22 |
| CVE-2026-112832 | critical | 9.8 | No | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CozyThemes Rootblox... | 2026-10-22 |
| CVE-2026-112822 | high | 8.5 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech Workreap Core workreap_core... | 2026-10-22 |