Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
52841
Total
4211
Critical
15646
High
15361
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2025-11977 | MEDIUM | 6.6 | The Happyforms – Form Builder for WordPress: Drag & Drop Contact Forms, Surveys, Payments & Multipurpose Forms plugin for WordPress is vulnerable to Local File … | Jul 10, 2026 |
| CVE-2026-40454 | HIGH | 7.5 | Out-of-bounds Read, Improper Input Validation vulnerability in Apache IoTDB C++ client. Out-of-bounds reads in IoTDB C++ client TsBlock deserializer crash client process on malformed server … | Jul 10, 2026 |
| CVE-2026-40452 | HIGH | 7.5 | Incorrect Authorization, Improper Access Control vulnerability in Apache IoTDB. Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users. This issue affects Apache IoTDB: … | Jul 10, 2026 |
| CVE-2026-40009 | MEDIUM | 6.5 | Improper Privilege Management, Improper Access Control vulnerability in Apache IoTDB. Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor. This issue … | Jul 10, 2026 |
| CVE-2026-40008 | CRITICAL | 9.8 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache IoTDB. The pipe processor reads a fully qualified Java class name … | Jul 10, 2026 |
| CVE-2026-40007 | HIGH | 7.5 | Uncontrolled Recursion, Uncontrolled Resource Consumption vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the IoTDB AirGap receiver's readLength method calls itself recursively each time it recognises the … | Jul 10, 2026 |
| CVE-2026-40006 | HIGH | 7.5 | Memory Allocation with Excessive Size Value, Allocation of Resources Without Limits or Throttling, Missing Authentication for Critical Function vulnerability in Apache IoTDB. When pipe_air_gap_receiver_enabled=true, the … | Jul 10, 2026 |
| CVE-2026-40005 | CRITICAL | 9.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache IoTDB. An attacker can write arbitrary files anywhere the IoTDB process … | Jul 10, 2026 |
| CVE-2026-28564 | CRITICAL | 9.8 | Insufficient Session Expiration, Authentication Bypass by Capture-replay vulnerability in Apache IoTDB. REST Basic Authentication Accepts Stale Cached Credentials This issue affects Apache IoTDB: from 1.0.0 … | Jul 10, 2026 |
| CVE-2026-13347 | HIGH | 7.5 | The Hide My WP Lite plugin for WordPress is vulnerable to Arbitrary File Read in versions up to and including 1.3 via the he_wrapper_js and … | Jul 10, 2026 |
| CVE-2026-12685 | HIGH | 7.5 | The EscortWP escortwp WordPress theme through 3.6.2 was distributed with a vendor-authored, obfuscated backdoor that lets an unauthenticated attacker who supplies a hard-coded, per-build key … | Jul 10, 2026 |
| CVE-2026-12276 | MEDIUM | 5.3 | The LA-Studio Element Kit for Elementor WordPress plugin before 1.6.1 does not check whether user registration is enabled on the site before creating an account … | Jul 10, 2026 |
| CVE-2026-12123 | MEDIUM | 6.4 | The All-in-One Video Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.8.5 via the 'vdl' parameter. … | Jul 10, 2026 |
| CVE-2026-21057 | UNKNOWN | — | Improper input validation in Samsung Pass prior to version 5.2.10.3 allows local privileged attackers to write out-of-bounds memory. | Jul 10, 2026 |
| CVE-2026-21056 | UNKNOWN | — | Improper authorization in Samsung Health prior to version 7.00.0.107 allows local attackers to access connected device information. | Jul 10, 2026 |
| CVE-2026-21055 | UNKNOWN | — | Improper export of android application components in Bixby prior to version 4.0.70.8 allows local attackers to execute arbitrary commands with Bixby privilege. | Jul 10, 2026 |
| CVE-2026-21054 | UNKNOWN | — | Improper export of android application components in InputSharing prior to version 2.7.01.4 allows local attackers to access sharing data. | Jul 10, 2026 |
| CVE-2026-21053 | UNKNOWN | — | Improper input validation in Samsung Email prior to version 6.2.13.1 allows local attackers to create arbitrary files within the application sandbox. | Jul 10, 2026 |
| CVE-2026-21052 | UNKNOWN | — | Path traversal in SemClipboardService prior to SMR Jul-2026 Release 1 allows local privileged attackers to access files with system privilege. | Jul 10, 2026 |
| CVE-2026-21051 | UNKNOWN | — | Incorrect default permissions in WLAN security prior to SMR Jul-2026 Release 1 allows local attackers to configure TencentWifiSecurity settings. | Jul 10, 2026 |
| CVE-2026-21050 | UNKNOWN | — | Improper access control in SmartThingsKit prior to SMR Jul-2026 Release 1 allows local attackers to access sensitive information. | Jul 10, 2026 |
| CVE-2026-21049 | UNKNOWN | — | Out-of-bounds write in libpadm.so library prior to SMR Jul-2026 Release 1 allows local attackers to execute arbitrary code. | Jul 10, 2026 |
| CVE-2026-21048 | UNKNOWN | — | Out-of-bounds write in parsing DNG format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory. | Jul 10, 2026 |
| CVE-2026-21046 | UNKNOWN | — | Time-of-check time-of-use race condition in fabricKeymaster trustlet prior to SMR Jul-2026 Release 1 allows local privileged attackers to execute arbitrary code. | Jul 10, 2026 |
| CVE-2026-21045 | UNKNOWN | — | Out-of-bounds write in parsing TIFF format in libimagecodec.media.quram.so prior to SMR Jul-2026 Release 1 allows remote attackers to write out-of-bounds memory. | Jul 10, 2026 |