Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2026-103302 | medium | 5.3 | No | The Payment Gateway for Idram WordPress plugin before 2.1.6 does not verify the authenticity of incoming payment notifications, because the... | 2026-10-21 |
| CVE-2026-102499 | high | 7.7 | No | The Modern Events Calendar Lite WordPress plugin before 7.37.0, Modern Event Calendar Pro WordPress plugin before 7.37.0 do not sanitise and... | 2026-10-21 |
| CVE-2026-100145 | medium | 6.5 | No | The Synchrony Financing WordPress plugin before 1.1.2 does not properly authorise requests to one of its REST routes that modifies WooCommer... | 2026-10-21 |
| CVE-2026-106569 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and res... | 2026-10-21 |
| CVE-2026-106570 | medium | 6.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacen... | 2026-10-21 |
| CVE-2026-106571 | medium | 5.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted lo... | 2026-10-21 |
| CVE-2026-106572 | medium | 5.3 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing re... | 2026-10-21 |
| CVE-2026-106573 | high | 7.5 | No | ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing li... | 2026-10-21 |
| CVE-2026-114251 | medium | 6.3 | No | A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unk... | 2026-10-21 |
| CVE-2026-112221 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart all... | 2026-10-21 |
| CVE-2026-111852 | critical | 9.3 | No | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax Search Lite ajax-search-... | 2026-10-21 |
| CVE-2026-111848 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allow... | 2026-10-21 |
| CVE-2026-111840 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com Paid Videochat Turnke... | 2026-10-21 |
| CVE-2026-111838 | high | 7.1 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk ThemeHunk Customizer themehu... | 2026-10-21 |
| CVE-2026-111837 | medium | 6.5 | No | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker Contest Gallery conte... | 2026-10-21 |
| CVE-2026-111835 | medium | 6.5 | No | Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting Incorrectly Configur... | 2026-10-21 |
| CVE-2026-111834 | critical | 9.9 | No | Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web Shell to a Web Serve... | 2026-10-21 |
| CVE-2026-111833 | high | 7.5 | No | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms weforms allows Path Traver... | 2026-10-21 |
| CVE-2026-111832 | critical | 10.0 | No | Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a Web Shell to a Web Serv... | 2026-10-21 |
| CVE-2026-114437 | medium | 4.8 | No | In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verif... | 2026-10-21 |