Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51605
Total
4093
Critical
15302
High
14954
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-64534 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest … | Jul 27, 2026 |
| CVE-2026-64533 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate lcns_follow in log_replay conversion log_replay() converts DIR_PAGE_ENTRY_32 records into DIR_PAGE_ENTRY records when replaying … | Jul 27, 2026 |
| CVE-2026-64532 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: bound NTFS_DE view.data_off in UpdateRecordData{Root,Allocation} In do_action()'s UpdateRecordDataRoot (fslog.c:3489) and UpdateRecordDataAllocation (fslog.c:3697) cases, the … | Jul 27, 2026 |
| CVE-2026-64531 | UNKNOWN | — | In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, … | Jul 27, 2026 |
| CVE-2026-14837 | HIGH | 7.8 | Multiple Lenze products are affected by an improper signature verification vulnerability in the SSH enablement mechanism. A low-privileged local attacker can bypass verification of the … | Jul 27, 2026 |
| CVE-2026-9830 | HIGH | 8.2 | The bookingpress-appointment-booking-pro WordPress plugin before 5.7.3 does not correctly invoke its REST permission callback, leaving every route in one of its API namespaces reachable without … | Jul 27, 2026 |
| CVE-2026-66412 | MEDIUM | 6.5 | Leantime 3.6.2 and prior contains a broken access control vulnerability that allows authenticated users to read milestone data from projects they are not assigned to … | Jul 27, 2026 |
| CVE-2026-14827 | MEDIUM | 6.8 | The Calendar WordPress plugin before 1.3.18 does not properly escape a user-supplied event field before outputting it inside an HTML attribute on a public-facing page, … | Jul 27, 2026 |
| CVE-2026-14820 | MEDIUM | 5.3 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.3 does not implement rate limiting or standard failed-login auditing on its front-end credential-check functionality and … | Jul 27, 2026 |
| CVE-2026-14568 | MEDIUM | 6.5 | The User Frontend: AI Powered Frontend Post Submission, User Directory, User Profile, Membership & User Registration WordPress plugin before 4.3.8 does not correctly verify ownership … | Jul 27, 2026 |
| CVE-2026-14289 | CRITICAL | 9.0 | The FacturaONE para WooCommerce con VeriFactu WordPress plugin before 5.37 does not authenticate one of its request handlers, whose only protection is derived from a … | Jul 27, 2026 |
| CVE-2026-14236 | MEDIUM | 4.7 | The Contact Form 7 WordPress plugin before 2.5 does not validate the host of a user-supplied return URL before using it as the success and … | Jul 27, 2026 |
| CVE-2026-14235 | HIGH | 7.5 | The Download Manager WordPress plugin before 3.3.62 does not bind its temporary download token to the requesting session nor expire it promptly, making the token … | Jul 27, 2026 |
| CVE-2026-14203 | MEDIUM | 4.8 | The Smart Manager WordPress plugin before 8.92.0 does not properly encode a post field before rendering it into an HTML attribute in its management grid, … | Jul 27, 2026 |
| CVE-2026-14190 | MEDIUM | 6.1 | The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers … | Jul 27, 2026 |
| CVE-2026-14189 | LOW | 3.8 | The WPBot WordPress plugin before 8.5.2 does not validate administrator-configured field identifiers before using them in a SQL query, allowing users with administrator access to … | Jul 27, 2026 |
| CVE-2026-13726 | HIGH | 7.1 | The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform … | Jul 27, 2026 |
| CVE-2026-13714 | CRITICAL | 9.8 | The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload … | Jul 27, 2026 |
| CVE-2026-13597 | CRITICAL | 9.1 | The 微信二维码登陆 WordPress plugin through 1.3 does not properly validate WeChat webhook requests, as its signature check always passes, and it discloses the generated login … | Jul 27, 2026 |
| CVE-2026-13400 | MEDIUM | 6.1 | Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: … | Jul 27, 2026 |
| CVE-2026-13390 | MEDIUM | 5.3 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips … | Jul 27, 2026 |
| CVE-2026-13332 | CRITICAL | 9.1 | The Masteriyo LMS WordPress plugin before 2.3.1 does not correctly verify authorization on an unauthenticated AJAX action used to clear user sessions, allowing unauthenticated attackers … | Jul 27, 2026 |
| CVE-2026-13152 | HIGH | 8.1 | The Custom Fields Account Registration For Woocommerce WordPress plugin before 1.4 does not prevent its custom registration fields from writing to the user capabilities meta … | Jul 27, 2026 |
| CVE-2026-12982 | MEDIUM | 6.1 | The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated … | Jul 27, 2026 |
| CVE-2026-12493 | HIGH | 7.5 | The Clover Payment Gateway by Zaytech for WooCommerce WordPress plugin before 1.3.6 does not verify that an approved external payment record actually belongs to the … | Jul 27, 2026 |