Vulnerabilities
Structured data from NIST NVD and the CISA KEV catalog. Fields the source has not provided are shown as such — nothing is inferred.
Archives: September 2026 October 2026 CISA KEV / threat intelligence
| CVE | Severity | CVSS | KEV | Description | Modified (UTC) |
|---|---|---|---|---|---|
| CVE-2025-7963 | medium | 6.4 | No | The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function i... | 2026-10-19 |
| CVE-2025-15664 | medium | 6.8 | No | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value bef... | 2026-10-19 |
| CVE-2025-15663 | medium | 6.8 | No | The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value befo... | 2026-10-19 |
| CVE-2025-46418 | high | 7.6 | No | Westermo WeOS 5.x starting from 5.24 allows OS command injection via a media definition. | 2026-10-19 |
| CVE-2025-12768 | not reported | — | No | A security issue exists within FactoryTalk® Historian Machine Edition. An attacker with low-level authentication could exploit this vulnerab... | 2026-10-19 |
| CVE-2025-15613 | medium | 6.5 | No | Kyverno before v1.13.4 is vulnerable to server-side request forgery (SSRF) via its Service Call functionality. An attacker with permission t... | 2026-10-19 |
| CVE-2026-97204 | low | 3.1 | No | Deleting a label compared the ID of the repository in the request against the organization ID of organization labels, and the two ID sequenc... | 2026-10-19 |
| CVE-2026-112310 | medium | 4.3 | No | docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying pla... | 2026-10-19 |
| CVE-2026-112058 | medium | 5.5 | No | VideoLAN libdvdnav through 7.0.0 contains an out-of-bounds read vulnerability in set_PTT that allows attackers to crash applications by supp... | 2026-10-19 |
| CVE-2026-112053 | medium | 5.5 | No | Schroedinger libschroedinger through 1.0.11 contains an out-of-bounds read vulnerability that allows attackers to read past a static quantis... | 2026-10-19 |
| CVE-2026-110494 | medium | 6.3 | No | Adding attachments to a release checked the repository and release of an attachment but not whether it was already linked to an issue or com... | 2026-10-19 |
| CVE-2026-110324 | medium | 6.5 | No | The visibility check of Gitea user profiles was applied to GET requests only, while `POST /{username}` (follow and unfollow) required only a... | 2026-10-19 |
| CVE-2026-110311 | medium | 4.3 | No | Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachme... | 2026-10-19 |
| CVE-2026-109844 | medium | 4.3 | No | `GET /api/v1/user/subscriptions` returned the metadata of every repository a user was watching without checking that the user still had acce... | 2026-10-19 |
| CVE-2026-109770 | medium | 6.1 | No | Spoofing issue in the DOM: Web Serial component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunde... | 2026-10-19 |
| CVE-2026-109764 | medium | 5.4 | No | Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and... | 2026-10-19 |
| CVE-2026-109762 | high | 8.8 | No | Incorrect boundary conditions in the SVG component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thu... | 2026-10-19 |
| CVE-2026-107083 | critical | 9.8 | No | SENAYAN Library Management System (SLiMS) Bulian (slims9_bulian) 9.8.0 is vulnerable to SQL Injection in admin/modules/reporting/customs/dl_... | 2026-10-19 |
| CVE-2026-105964 | medium | 6.5 | No | The Gitea Actions artifact v4 (Twirp) handlers read the whole request body into memory without a size limit. A user who can run a workflow a... | 2026-10-19 |
| CVE-2026-105661 | medium | 5.3 | No | Requesting `/{username}/-/repositories` for an individual user instead of an organization made the organization home handler dereference a n... | 2026-10-19 |