Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
51698
Total
4098
Critical
15338
High
14987
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-16544 | MEDIUM | 6.5 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function … | Jul 22, 2026 |
| CVE-2025-13146 | MEDIUM | 6.5 | The The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, … | Jul 22, 2026 |
| CVE-2026-16473 | MEDIUM | 4.3 | A flaw was found in the sbc library (BlueZ SBC codec). An off-by-one error in the SBC frame decoder allows a crafted audio payload to … | Jul 22, 2026 |
| CVE-2026-14551 | HIGH | 8.8 | The servereye client (also known as sensorhub, technically ClientAgentContainerService) versions 20.15 and earlier are vulnerable to Local Privilege Escalation. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe), running … | Jul 22, 2026 |
| CVE-2026-63264 | UNKNOWN | — | The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller. | Jul 22, 2026 |
| CVE-2026-2406 | MEDIUM | 6.5 | Authorization bypass through User-Controlled key vulnerability in Universe Software Computer Marketing Trade and Industry Inc. Online Registration and Workflow Management System allows Exploiting Trust in … | Jul 22, 2026 |
| CVE-2026-15787 | MEDIUM | 6.4 | The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Navigation Menu Widget data-toggle-icon/data-close-icon Attributes in all versions up to, … | Jul 22, 2026 |
| CVE-2026-63048 | UNKNOWN | — | The Joomla extension Page Builder CK is vulnerable to an authenticated arbitrary file upload, leading to RCE. | Jul 22, 2026 |
| CVE-2026-63047 | HIGH | 7.5 | The Joomla extension Events Booking prior version 5.0-5.8.1 did not properly verify that an actor is allowed to download invoice information. | Jul 22, 2026 |
| CVE-2026-45820 | UNKNOWN | — | fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync(). A crafted ZIP archive with a central directory entry declaring … | Jul 22, 2026 |
| CVE-2026-3821 | HIGH | 8.8 | Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data … | Jul 22, 2026 |
| CVE-2026-14322 | MEDIUM | 5.3 | The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its … | Jul 22, 2026 |
| CVE-2026-12987 | HIGH | 7.5 | The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored … | Jul 22, 2026 |
| CVE-2026-12968 | HIGH | 8.8 | The Product Addons and Product Options With Custom Fields WordPress plugin before 1.6.15 does not restrict an unauthenticated file-upload endpoint and accepts SVG files that … | Jul 22, 2026 |
| CVE-2026-15802 | HIGH | 8.1 | The WP Foodbakery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'delete_locations_backup_file_callback' function in all versions … | Jul 22, 2026 |
| CVE-2026-56844 | UNKNOWN | — | A vulnerability in the Veeam Updater component of the Veeam Software Appliance that could allow a local user to elevate their privileges and gain root-level … | Jul 22, 2026 |
| CVE-2026-16492 | MEDIUM | 5.5 | A weakness has been identified in umijs umi up to 4.6.63. The affected element is the function git.getFileCreateInfo of the file packages/utils/src/getFileGitIno.ts of the component … | Jul 22, 2026 |
| CVE-2026-16490 | MEDIUM | 6.3 | A security flaw has been discovered in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /prescription.php. The manipulation of the … | Jul 22, 2026 |
| CVE-2026-63263 | MEDIUM | 6.5 | Uncontrolled Resource Consumption (CWE-400) in Elasticsearch can lead to denial of service via Exponential Data Expansion (CAPEC-197). An authenticated user may submit a specially crafted … | Jul 22, 2026 |
| CVE-2026-63262 | MEDIUM | 4.3 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control. | Jul 22, 2026 |
| CVE-2026-16489 | MEDIUM | 5.3 | A vulnerability was identified in jsforce up to 3.10.16. This issue affects the function _execCommand in the library lib/registry/sfdx.js of the component SFDX Connection Registry. … | Jul 22, 2026 |
| CVE-2026-16488 | MEDIUM | 5.0 | A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing … | Jul 22, 2026 |
| CVE-2026-63261 | MEDIUM | 6.5 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). A low-privileged authenticated user can send a specially crafted … | Jul 21, 2026 |
| CVE-2026-63260 | MEDIUM | 6.5 | Uncontrolled Resource Consumption (CWE-400) in Kibana can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated attacker with low-privilege access can trigger a … | Jul 21, 2026 |
| CVE-2026-63259 | MEDIUM | 4.3 | Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana can lead to information disclosure via user-supplied identifiers that reference scheduled query result data from Kibana Spaces … | Jul 21, 2026 |