{ "query": { "page": "19" }, "count": 20, "total": 46756, "page": 19, "limit": 20, "updated": { "cves": "2026-10-06T12:45:42.157Z", "kev": "2026-10-06T13:44:43.860Z", "epss": "2026-10-06T12:57:42.533Z", "breaches": "2026-10-06T12:45:41.825Z", "posts": "2026-10-06T13:45:44.551Z" }, "links": { "web": "https://spydr.io/threats?page=19", "next": "https://spydr.io/threats.json?page=20" }, "warnings": [], "results": [ { "id": "CVE-2026-57545", "url": "https://spydr.io/cve/CVE-2026-57545", "published": "2026-10-06T07:16:58.437Z", "modified": "2026-10-06T07:16:58.437Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-822" ], "description": "Memory corruption when processing draw objects of incorrect type during graphics command list execution." }, { "id": "CVE-2026-57537", "url": "https://spydr.io/cve/CVE-2026-57537", "published": "2026-10-06T07:16:58.300Z", "modified": "2026-10-06T07:16:58.300Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-416" ], "description": "Memory Corruption when accessing and modifying geographic mapping data concurrently without proper synchronization." }, { "id": "CVE-2026-25302", "url": "https://spydr.io/cve/CVE-2026-25302", "published": "2026-10-06T07:16:58.040Z", "modified": "2026-10-06T07:16:58.040Z", "score": 7.1, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-347" ], "description": "Cryptographic Issue when processing non-ELF partitions, authentication and signature checks are bypassed, allowing unsigned or corrupted images to be mounted and processed." }, { "id": "CVE-2026-25291", "url": "https://spydr.io/cve/CVE-2026-25291", "published": "2026-10-06T07:16:57.893Z", "modified": "2026-10-06T07:16:57.893Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-416" ], "description": "Memory corruption when performing concurrent operations on shared memory page lists due to lack of proper synchronization mechanisms." }, { "id": "CVE-2026-25274", "url": "https://spydr.io/cve/CVE-2026-25274", "published": "2026-10-06T07:16:57.770Z", "modified": "2026-10-06T07:16:57.770Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-416" ], "description": "Memory Corruption when processing concurrent DMA buffer allocation and deallocation commands without proper synchronization." }, { "id": "CVE-2026-25273", "url": "https://spydr.io/cve/CVE-2026-25273", "published": "2026-10-06T07:16:57.647Z", "modified": "2026-10-06T07:16:57.647Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-787" ], "description": "Memory Corruption when processing camera operations due to out-of-bounds write during driver updates." }, { "id": "CVE-2026-25272", "url": "https://spydr.io/cve/CVE-2026-25272", "published": "2026-10-06T07:16:57.490Z", "modified": "2026-10-06T07:16:57.490Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-787" ], "description": "Memory Corruption when processing camera CRE driver operations with improper handling of buffer limits during hardware update preparation." }, { "id": "CVE-2026-25270", "url": "https://spydr.io/cve/CVE-2026-25270", "published": "2026-10-06T07:16:57.367Z", "modified": "2026-10-06T07:16:57.367Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-787" ], "description": "Memory corruption when processing command buffer requests with invalid length parameters in the Android Camera driver." }, { "id": "CVE-2026-25269", "url": "https://spydr.io/cve/CVE-2026-25269", "published": "2026-10-06T07:16:57.207Z", "modified": "2026-10-06T07:16:57.207Z", "score": 6.7, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-787" ], "description": "Memory corruption when processing camera requests with excessive batch and IO buffer configurations exceeds allocated memory size." }, { "id": "CVE-2026-25267", "url": "https://spydr.io/cve/CVE-2026-25267", "published": "2026-10-06T07:16:56.997Z", "modified": "2026-10-06T07:16:56.997Z", "score": 7.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-862" ], "description": "Memory corruption when non-secure loader rewrites page tables before secure memory initialization." }, { "id": "CVE-2026-25263", "url": "https://spydr.io/cve/CVE-2026-25263", "published": "2026-10-06T07:16:56.747Z", "modified": "2026-10-06T07:16:56.747Z", "score": 6.6, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:H/A:L", "score_source": "qualcomm.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Qualcomm, Inc." ], "products": [ "Qualcomm, Inc. Snapdragon" ], "cwes": [ "CWE-787" ], "description": "Memory corruption while processing IOCTL command called from user space to the kernel with invalid parameters." }, { "id": "CVE-2026-105778", "url": "https://spydr.io/cve/CVE-2026-105778", "published": "2026-10-06T07:16:56.547Z", "modified": "2026-10-06T07:16:56.547Z", "score": 8.6, "severity": "high", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Tenda" ], "products": [ "Tenda AC5" ], "cwes": [ "CWE-119", "CWE-121" ], "description": "A vulnerability has been found in Tenda AC5 02.03.01.111_multi. Affected by this issue is some unknown functionality of the file /goform/setWifi of the component Wifi Handler. Such manipulation of the argument wifiPwd leads to stack-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used." }, { "id": "CVE-2026-105776", "url": "https://spydr.io/cve/CVE-2026-105776", "published": "2026-10-06T07:16:56.357Z", "modified": "2026-10-06T07:16:56.357Z", "score": 5.5, "severity": "medium", "cvss_version": "4.0", "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "score_source": "vuldb.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "bhagya3929" ], "products": [ "bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL" ], "cwes": [ "CWE-74", "CWE-89" ], "description": "A flaw has been found in bhagya3929 Employee-Movement-Tracking-and-Monitoring-Website-for-IOCL up to ae783195ba7e0390d3b3bfaddd99944b7e9735a4. Affected by this vulnerability is an unknown functionality of the file /admin_transaction.php. This manipulation of the argument Username causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet." }, { "id": "CVE-2026-105701", "url": "https://spydr.io/cve/CVE-2026-105701", "published": "2026-10-06T07:16:56.207Z", "modified": "2026-10-06T07:16:56.207Z", "score": 8.8, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "wordfence.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "Mauro Cassani" ], "products": [ "Mauro Cassani ACPT (Premium)" ], "cwes": [ "CWE-434" ], "description": "The ACPT (Premium) plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes it possible for authenticated attackers, with subscriber-level access and above, to execute code on the server. The exploit requires the attacker to first create a form with malicious email_settings via the REST API endpoint, then trigger form submission to execute the injected Twig expressions." }, { "id": "CVE-2026-97300", "url": "https://spydr.io/cve/CVE-2026-97300", "published": "2026-10-06T06:17:02.110Z", "modified": "2026-10-06T11:17:31.863Z", "score": 6.5, "severity": "medium", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", "score_source": "patchstack.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Arraytics" ], "products": [ "Arraytics WP Event Solution" ], "cwes": [ "CWE-799" ], "description": "Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions." }, { "id": "CVE-2026-75962", "url": "https://spydr.io/cve/CVE-2026-75962", "published": "2026-10-06T06:17:01.687Z", "modified": "2026-10-06T06:17:01.687Z", "score": 7.2, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "score_source": "wordfence.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": null, "vendors": [ "saadiqbal" ], "products": [ "saadiqbal Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App" ], "cwes": [ "CWE-79" ], "description": "The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message." }, { "id": "CVE-2026-41563", "url": "https://spydr.io/cve/CVE-2026-41563", "published": "2026-10-06T06:17:01.530Z", "modified": "2026-10-06T11:17:27.837Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "score_source": "patchstack.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Dawer Drew" ], "products": [ "Dawer Drew Sitemovr" ], "cwes": [ "CWE-201" ], "description": "Unauthenticated Sensitive Data Exposure in Sitemovr <= 1.0.1 versions." }, { "id": "CVE-2026-41558", "url": "https://spydr.io/cve/CVE-2026-41558", "published": "2026-10-06T06:17:01.370Z", "modified": "2026-10-06T11:17:27.297Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "score_source": "patchstack.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "WP Synchro" ], "products": [ "WP Synchro WP Migration Plugin DB & Files – WP Synchro" ], "cwes": [ "CWE-290" ], "description": "Subscriber Bypass Vulnerability in WP Migration Plugin DB & Files – WP Synchro <= 1.16.1 versions." }, { "id": "CVE-2026-39789", "url": "https://spydr.io/cve/CVE-2026-39789", "published": "2026-10-06T06:17:01.227Z", "modified": "2026-10-06T11:17:25.903Z", "score": 7.5, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "score_source": "patchstack.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "WP Manage Ninja" ], "products": [ "WP Manage Ninja Fluent Affiliate Pro" ], "cwes": [ "CWE-862" ], "description": "Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions." }, { "id": "CVE-2026-39760", "url": "https://spydr.io/cve/CVE-2026-39760", "published": "2026-10-06T06:17:01.087Z", "modified": "2026-10-06T11:17:23.203Z", "score": 7.1, "severity": "high", "cvss_version": "3.1", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "score_source": "patchstack.com", "epss": null, "epss_percentile": null, "exploited": false, "kev": null, "ssvc_exploitation": "none", "vendors": [ "Creative interactive media" ], "products": [ "Creative interactive media Real 3D FlipBook" ], "cwes": [ "CWE-79" ], "description": "Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions." } ], "attribution": [ { "source": "NVD", "url": "https://nvd.nist.gov", "notice": "This product uses data from the NVD API but is not endorsed or certified by the NVD." }, { "source": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "notice": "Known exploited vulnerabilities from the CISA KEV catalog." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss", "notice": "Exploit prediction scores from FIRST EPSS." } ] }