Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-64584 | medium | 5.4 | No | Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker... | 2026-10-19 |
| CVE-2025-64542 | medium | 5.4 | No | Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu... | 2026-10-19 |
| CVE-2025-52657 | low | 3.5 | No | HCL MyXalytics was affected by Potential DOS Vulnerability. It allows users to input data without any restriction on the number of character... | 2026-10-19 |
| CVE-2025-52652 | low | 3.5 | No | HCL MyXalytics was affected by Content Spoofing Vulnerability. It may allow an attacker to manipulate displayed content, making it appear as... | 2026-10-19 |
| CVE-2025-52651 | low | 3.5 | No | HCL MyXalytics was affected by Improper Input validation Vulnerability. It allow malicious or unexpected data to cause unintended system beh... | 2026-10-19 |
| CVE-2025-9049 | high | 8.8 | No | The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability che... | 2026-10-19 |
| CVE-2025-15647 | medium | 5.5 | No | CDT before 1.4.5 contains an out-of-bounds read vulnerability in the opposedVertexInd() function when constraint edge intersections are comp... | 2026-10-19 |
| CVE-2025-15614 | low | 3.3 | No | ugrep before 7.6.0 contains a heap buffer over-read vulnerability in the LZW decompressor when processing crafted .Z archive files. Attacker... | 2026-10-19 |
| CVE-2025-15694 | low | 3.5 | No | The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admi... | 2026-10-19 |
| CVE-2025-15693 | low | 2.7 | No | The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-brows... | 2026-10-19 |
| CVE-2025-14945 | medium | 5.4 | No | The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attr... | 2026-10-19 |
| CVE-2025-15691 | medium | 5.3 | No | The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from o... | 2026-10-19 |
| CVE-2025-12737 | high | 8.4 | No | The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a mal... | 2026-10-19 |
| CVE-2025-9314 | critical | 9.8 | No | The Developer Tools WordPress plugin through 1.1.3 contains an unauthenticated arbitrary file upload vulnerability in the bundled SWFUpload... | 2026-10-19 |
| CVE-2025-8945 | medium | 5.3 | No | The Wp Edit Password Protected WordPress plugin before 1.3.5 allows protecting page content, but this protection can be bypassed by using th... | 2026-10-19 |
| CVE-2025-15692 | low | 3.5 | No | The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML at... | 2026-10-19 |
| CVE-2025-15490 | medium | 5.3 | No | The Passster WordPress plugin before 4.2.26 has a flaw in its global protection checks, allowing unauthenticated users to bypass the protect... | 2026-10-19 |
| CVE-2025-15489 | medium | 5.3 | No | The Passster WordPress plugin before 4.2.24 does not handle input properly in an AJAX action, allowing unauthenticated users to retrieve the... | 2026-10-19 |
| CVE-2025-15485 | high | 8.2 | No | The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated us... | 2026-10-19 |
| CVE-2025-15481 | medium | 5.3 | No | The Notification Bar for WordPress plugin through 1.1.8 exposes an unauthenticated CSV export script that discloses all stored subscriber em... | 2026-10-19 |