Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51620
Total
4095
Critical
15305
High
14964
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-15420 | MEDIUM | 4.3 | The Nexter Blocks – Gutenberg Blocks, Page Builder & AI Website Builder plugin for WordPress is vulnerable to Directory Traversal in all versions up to, … | Jul 24, 2026 |
| CVE-2026-15100 | MEDIUM | 6.4 | The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, … | Jul 24, 2026 |
| CVE-2026-13464 | MEDIUM | 5.3 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, … | Jul 24, 2026 |
| CVE-2026-12736 | HIGH | 8.0 | The Wpify Woo plugin for WordPress is vulnerable to Privilege Escalation in versions up to, and including, 5.4.16. This is due to the SettingsApi::save_option() REST … | Jul 24, 2026 |
| CVE-2026-11922 | MEDIUM | 6.5 | A vulnerability in zenml-io/zenml versions 0.57.0 through 0.94.2 allows an attacker to bypass rate-limiting on the `POST /api/v1/login` and self password-change endpoints by rotating the … | Jul 24, 2026 |
| CVE-2026-11354 | MEDIUM | 5.3 | The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This … | Jul 24, 2026 |
| CVE-2025-9205 | MEDIUM | 6.4 | The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input … | Jul 24, 2026 |
| CVE-2026-62825 | CRITICAL | 10.0 | Improper authentication in Azure Key Vault allows an unauthorized attacker to elevate privileges over a network. | Jul 24, 2026 |
| CVE-2026-58275 | CRITICAL | 10.0 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. | Jul 24, 2026 |
| CVE-2026-56191 | CRITICAL | 10.0 | Improper authentication in Microsoft Exchange Online allows an unauthorized attacker to perform tampering over a network. | Jul 24, 2026 |
| CVE-2026-56167 | HIGH | 8.5 | Server-side request forgery (ssrf) in Azure AI Search allows an authorized attacker to elevate privileges over a network. | Jul 24, 2026 |
| CVE-2026-56165 | CRITICAL | 9.8 | Heap-based buffer overflow in Microsoft Account allows an unauthorized attacker to execute code over a network. | Jul 24, 2026 |
| CVE-2026-56160 | CRITICAL | 9.1 | Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a network. | Jul 24, 2026 |
| CVE-2026-54120 | CRITICAL | 9.9 | Improper input validation in Microsoft Surface allows an authorized attacker to execute code over a network. | Jul 24, 2026 |
| CVE-2026-50517 | CRITICAL | 9.9 | Deserialization of untrusted data in M365 Copilot allows an authorized attacker to execute code over a network. | Jul 24, 2026 |
| CVE-2026-49159 | MEDIUM | 6.5 | Exposure of sensitive information to an unauthorized actor in Microsoft Graph allows an authorized attacker to disclose information over a network. | Jul 24, 2026 |
| CVE-2026-35425 | HIGH | 8.0 | Improper access control in Azure API Management (APIM) allows an authorized attacker to execute code over a network. | Jul 24, 2026 |
| CVE-2026-50044 | MEDIUM | 6.8 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an inadequate encryption strength vulnerability which could allow an attacker to steal admin credentials via weak hash or … | Jul 23, 2026 |
| CVE-2026-44955 | MEDIUM | 5.3 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could allow for asset discovery … | Jul 23, 2026 |
| CVE-2026-42933 | CRITICAL | 10.0 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an unintended proxy or intermediary vulnerability which could allow an attacker to use an active proxy, which would … | Jul 23, 2026 |
| CVE-2026-40430 | HIGH | 7.5 | Pronetiqs IntraVUE Versions 3.2.1a14 and prior have a plaintext storage of a password vulnerability that could expose cleartext credentials through the API. | Jul 23, 2026 |
| CVE-2026-28698 | HIGH | 8.6 | Pronetiqs IntraVUE versions 3.2.1a14 and prior have an exposure of sensitive system information to an unauthorized control sphere vulnerability which could expose the underlying host/share … | Jul 23, 2026 |
| CVE-2026-16767 | MEDIUM | 6.5 | A vulnerability was detected in Ne-Lexa php-zip up to 4.0.2. This affects the function ZipFile::extractTo of the file src/ZipFile.php of the component ZIP Handler. Performing … | Jul 23, 2026 |
| CVE-2026-65694 | HIGH | 7.5 | Microweber CMS through 2.0.20 contains a path traversal vulnerability in the static file controller that allows unauthenticated remote attackers to read arbitrary files by supplying … | Jul 23, 2026 |
| CVE-2026-65604 | HIGH | 8.2 | Skipper contains an incomplete fix for CVE-2026-50197 in which oversized request bodies bypass Open Policy Agent (OPA) deny-on-presence Rego policies. When a request body exceeds … | Jul 23, 2026 |