Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
30979
Total
2442
Critical
9135
High
9510
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-35196 | HIGH | 8.8 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, an OS Command Injection vulnerability exists in the main/inc/ajax/gradebook.ajax.php endpoint within the … | Apr 14, 2026 |
| CVE-2026-34631 | HIGH | 7.8 | InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the … | Apr 14, 2026 |
| CVE-2026-34619 | HIGH | 7.7 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result … | Apr 14, 2026 |
| CVE-2026-34602 | HIGH | 7.1 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the /api/course_rel_users endpoint is vulnerable to Insecure Direct Object Reference (IDOR), allowing … | Apr 14, 2026 |
| CVE-2026-34370 | MEDIUM | 6.5 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the notebook module contains an Insecure Direct Object Reference (IDOR) vulnerability that … | Apr 14, 2026 |
| CVE-2026-34213 | MEDIUM | 5.4 | Docmost is open-source collaborative wiki and documentation software. Starting in version 0.3.0 and prior to version 0.71.0, improper authorization in Docmost allows a low-privileged authenticated … | Apr 14, 2026 |
| CVE-2026-34212 | MEDIUM | 5.4 | Docmost is open-source collaborative wiki and documentation software. In versions prior to 0.71.0, improper neutralization of attachment URLs in Docmost allows a low-privileged authenticated user … | Apr 14, 2026 |
| CVE-2026-33193 | MEDIUM | 4.6 | Docmost is open-source collaborative wiki and documentation software. Versions prior to 0.70.0 are vulnerable to a stored cross-site scripting (XSS) attack due to improper handling … | Apr 14, 2026 |
| CVE-2026-33146 | MEDIUM | 4.3 | Docmost is open-source collaborative wiki and documentation software. An authorization bypass vulnerability in versions 0.70.0 through 0.70.2 exposes restricted child page titles and text snippets … | Apr 14, 2026 |
| CVE-2026-33020 | HIGH | 7.1 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow which leads to a heap buffer overflow … | Apr 14, 2026 |
| CVE-2026-33019 | HIGH | 7.1 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain an integer overflow leading to an out-of-bounds heap read in … | Apr 14, 2026 |
| CVE-2026-33018 | HIGH | 7.0 | libsixel is a SIXEL encoder/decoder implementation derived from kmiya's sixel. Versions 1.8.7 and prior contain a Use-After-Free vulnerability via the load_gif() function in fromgif.c, where … | Apr 14, 2026 |
| CVE-2026-27308 | LOW | 2.4 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit … | Apr 14, 2026 |
| CVE-2026-27307 | LOW | 2.4 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. A high-privileged attacker could exploit … | Apr 14, 2026 |
| CVE-2026-27306 | HIGH | 8.4 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of … | Apr 14, 2026 |
| CVE-2026-27305 | HIGH | 8.6 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead … | Apr 14, 2026 |
| CVE-2026-27304 | CRITICAL | 9.3 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of … | Apr 14, 2026 |
| CVE-2026-27282 | HIGH | 7.5 | ColdFusion versions 2023.18, 2025.6 and earlier are affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacker could … | Apr 14, 2026 |
| CVE-2025-15565 | MEDIUM | 5.3 | The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versions … | Apr 14, 2026 |
| CVE-2026-34161 | UNKNOWN | — | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the social post attachment … | Apr 14, 2026 |
| CVE-2026-34160 | HIGH | 8.6 | Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, the PENS (Package Exchange Notification Services) plugin endpoint at public/plugin/Pens/pens.php is accessible … | Apr 14, 2026 |
| CVE-2026-33715 | HIGH | 7.2 | Chamilo LMS is an open-source learning management system. In version 2.0-RC.2, the file public/main/inc/ajax/install.ajax.php is accessible without authentication on fully installed instances because, unlike other … | Apr 14, 2026 |
| CVE-2026-33714 | UNKNOWN | — | Chamilo is an open-source learning management system (LMS). Version 2.0.0-RC.2 contains a SQL Injection vulnerability in the statistics AJAX endpoint, which is an incomplete fix … | Apr 14, 2026 |
| CVE-2026-27287 | HIGH | 7.8 | InCopy versions 20.5.2, 21.2 and earlier are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past … | Apr 14, 2026 |
| CVE-2026-25133 | UNKNOWN | — | October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the … | Apr 14, 2026 |