Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
30979
Total
2442
Critical
9135
High
9510
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-26291 | MEDIUM | 5.4 | Stored cross-site scripting vulnerability exists in GROWI v7.4.6 and earlier. If this vulnerability is exploited, an arbitrary script may be executed in a user's web … | Apr 15, 2026 |
| CVE-2026-6328 | UNKNOWN | — | Improper input validation, Improper verification of cryptographic signature vulnerability in XQUIC Project XQUIC xquic on Linux (QUIC protocol implementation, packet processing module, STREAM frame handler … | Apr 15, 2026 |
| CVE-2026-4812 | MEDIUM | 5.3 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including 6.7.0. This … | Apr 15, 2026 |
| CVE-2026-40499 | UNKNOWN | — | radare2 prior to version 6.1.4 contains a command injection vulnerability in the PDB parser's print_gvars() function that allows attackers to execute arbitrary commands by embedding … | Apr 15, 2026 |
| CVE-2026-40105 | UNKNOWN | — | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 10.4-rc-1, through 16.10.15, 17.0.0-rc-1, through 17.4.7 and … | Apr 15, 2026 |
| CVE-2026-40104 | UNKNOWN | — | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Versions 1.8-rc-1, 17.0.0-rc-1 and 17.5.0-rc-1 and prior include … | Apr 15, 2026 |
| CVE-2026-40096 | UNKNOWN | — | immich is a high performance self-hosted photo and video management solution. Versions prior to 2.7.3 contain an open redirect vulnerability in the shared album functionality, … | Apr 15, 2026 |
| CVE-2026-40091 | MEDIUM | 6.0 | SpiceDB is an open source database system for creating and managing security-critical application permissions. In versions 1.49.0 through 1.51.0, when SpiceDB starts with log level … | Apr 15, 2026 |
| CVE-2026-40090 | HIGH | 7.1 | Zarf is an Airgap Native Packager Manager for Kubernetes. Versions 0.23.0 through 0.74.1 contain an arbitrary file write vulnerability in the zarf package inspect sbom … | Apr 15, 2026 |
| CVE-2026-39984 | MEDIUM | 5.5 | Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse … | Apr 15, 2026 |
| CVE-2026-39971 | HIGH | 7.2 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the email sending functionality in include/functions.inc.php inserts $_SERVER['HTTP_HOST'] directly into the Message-ID SMTP header … | Apr 15, 2026 |
| CVE-2026-39963 | MEDIUM | 6.9 | Serendipity is a PHP-powered weblog engine. In versions 2.6-beta2 and below, the serendipity_setCookie() function in include/functions_config.inc.php uses $_SERVER['HTTP_HOST'] without validation as the domain parameter of … | Apr 15, 2026 |
| CVE-2026-39884 | HIGH | 8.3 | mcp-server-kubernetes is a Model Context Protocol server for Kubernetes cluster management. Versions 3.4.0 and prior contain an argument injection vulnerability in the port_forward tool in … | Apr 15, 2026 |
| CVE-2026-39842 | CRITICAL | 9.9 | OpenRemote is an open-source IoT platform. Versions 1.21.0 and below contain two interrelated expression injection vulnerabilities in the rules engine that allow arbitrary code execution … | Apr 15, 2026 |
| CVE-2026-33806 | HIGH | 7.5 | Impact: Fastify applications using schema.body.content for per-content-type body validation can have validation bypassed entirely by prepending a space to the Content-Type header. The body is … | Apr 15, 2026 |
| CVE-2026-2834 | HIGH | 7.2 | The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘description’ parameter in all … | Apr 15, 2026 |
| CVE-2026-2396 | MEDIUM | 4.4 | The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up to, and including, … | Apr 15, 2026 |
| CVE-2026-1555 | CRITICAL | 9.8 | The WebStack theme for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the io_img_upload() function in all versions up … | Apr 15, 2026 |
| CVE-2026-1541 | MEDIUM | 4.3 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.15.1. This is due to … | Apr 15, 2026 |
| CVE-2026-1509 | MEDIUM | 5.4 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due … | Apr 15, 2026 |
| CVE-2026-1314 | MEDIUM | 5.3 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a … | Apr 15, 2026 |
| CVE-2025-54550 | UNKNOWN | — | The example example_xcom that was included in airflow documentation implemented unsafe pattern of reading value from xcom in the way that could be exploited to … | Apr 15, 2026 |
| CVE-2025-15470 | MEDIUM | 6.5 | The Eleganzo theme for WordPress is vulnerable to arbitrary directory deletion due to insufficient path validation in the akd_required_plugin_callback function in all versions up to, … | Apr 15, 2026 |
| CVE-2026-40688 | HIGH | 7.2 | An out-of-bounds write vulnerability [CWE-787] vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.3, FortiWeb 7.6.0 through 7.6.6, FortiWeb 7.4.0 through 7.4.11 may allow a remote privileged … | Apr 14, 2026 |
| CVE-2026-39399 | CRITICAL | 9.6 | NuGet Gallery is a package repository that powers nuget.org. A security vulnerability exists in the NuGetGallery backend job’s handling of .nuspec files within NuGet packages. … | Apr 14, 2026 |